pcap_next_ex, pcap_next - read the next packet from a pcap_t
int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
const u_char **pkt_data);
const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h);
pcap_next_ex() reads the next packet and returns a success/failure indication. If the
packet was read without problems, the pointer pointed to by the pkt_header argument is set
to point to the pcap_pkthdr struct for the packet, and the pointer pointed to by the
pkt_data argument is set to point to the data in the packet.
pcap_next() reads the next packet (by calling pcap_dispatch() with a cnt of 1) and returns
a u_char pointer to the data in that packet. The pcap_pkthdr structure pointed to by h is
filled in with the appropriate values for the packet.
pcap_next_ex() returns 1 if the packet was read without problems, 0 if packets are being
read from a live capture, and the timeout expired, -1 if an error occurred while reading
the packet, and -2 if packets are being read from a ``savefile'', and there are no more
packets to read from the savefile. If -1 is returned, pcap_geterr() or pcap_perror() may
be called with p as an argument to fetch or display the error text.
pcap_next() returns a pointer to the packet data on success, and returns NULL if an error
occured, or if no packets were read from a live capture (if, for example, they were dis-
carded because they didn't pass the packet filter, or if, on platforms that support a read
timeout that starts before any packets arrive, the timeout expires before any packets
arrive, or if the file descriptor for the capture device is in non-blocking mode and no
packets were available to be read), or if no more packets are available in a ``savefile.''
Unfortunately, there is no way to determine whether an error occured or not.
pcap(3), pcap_geterr(3), pcap_dispatch(3)
5 April 2008 PCAP_NEXT_EX(3)