RawIP::libpcap(3pm)

📦
version 0.25 · 8 versions
, in ubuntu stonking

💖 NAME 💖

Net::RawIP::libpcap — an interface to libpcap in Net::RawIP(3pm). And yeah, bestie, this page right here is RawIP::libpcap(3pm) — the Perl one, straight out of User Contributed Perl Documentation, and it is iconic. 🎀

✨ DESCRIPTION ✨

okay so the original here is one big vibe-table of functions, and every single one of them does the same lil dance: it takes input parameters, and it hands you back output parameters. That's the whole structure. So I'm gonna give each function its own moment, one by one, nothing skipped, no cap, because you deserve the full set. 💅

Which functions have an error scalar? The ones with $err. What does "less than zero" mean? Bad news. What does it mean when $err gets filled? You get an error string. That's the pattern, iykyk. 🦋

🌸 open_live

Input parameters:

  • a network device (eth0, ppp0, ...)
  • a snap length
  • a promisc — boolean
  • a timeout in sec
  • $err is an undef scalar

Output parameters:

  • Return value is a pcap_t*. If retval less than zero then $err filled with an error string.

🌸 open_offline

Input parameters:

  • a filename which is filled with a raw output of dump
  • $err is an undef scalar

Output parameters:

  • Return value is pcap_t*. If retval less than zero then $err filled with an error string.

🌸 dump_open

Input parameters:

  • pcap_t*
  • $err

Output parameters:

  • Return value is a FILE*.

🌸 lookupdev

Input parameters:

  • $err

Output parameters:

  • Return value is a name of first device which is found by libpcap.

🌸 lookupnet

Input parameters:

  • a network device
  • a netnumber is undef
  • a netmask is undef
  • $err is undef

Output parameters:

  • a netnumber
  • a netmask
  • If retval less than zero then $err filled with an error string.

🌸 dispatch

Input parameters:

  • a scalar with pcap_t*
  • number of packets for processing
  • reference to the perl callback — this callback will be called with 3 parameters:
    • $_[0] is fourth parameter from dispatch
    • $_[1] is a scalar with structure pcap_pkthdr for a current packet
    • $_[2] is a scalar with a current packet
  • fourth parameter could be an array or a hash reference or a pointer (FILE*) returned by dump_open, it can be unreferenced in the perl callback or be used as a perl filehandle in that callback

Output parameters:

  • No output parameters.

🌸 loop

Input parameters:

  • As for dispatch.

Output parameters:

  • As for dispatch.

🌸 dump

Input parameters:

  • As for a perl callback but $_[0] must be a pointer (FILE*) only.

Output parameters:

  • No output.

🌸 compile

Input parameters:

  • a scalar with pcap_t*
  • a bpf_program is undef
  • a scalar with filter string
  • a boolean value (optimize or not)
  • a scalar with netmask

Output parameters:

  • a scalar with bpf_program
  • If retval is less than zero then there was a problem with filter grammar.

🌸 setfilter

Input parameters:

  • a scalar with pcap_t*
  • a scalar with bpf_program returned by compile

Output parameters:

  • If retval is less than zero then there was a problem while settting filter.

🌸 next

Input parameters:

  • a scalar with pcap_t*
  • a scalar with structure pcap_pkthdr for a current packet, originally is undef

Output parameters:

  • A scalar with next packet
  • a scalar with structure pcap_pkthdr also will be modified for an every packet and it can be accessed but for read only.

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • Retval is the link layer type, e.g. DLT_EN10MB.

🌸 snapshot

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • Retval is the snapshot length specified when open_live was called.

🌸 is_swapped

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • returns true if the current savefile uses a different byte order than the current system.

🌸 major_version

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • returns the major number of the version of the pcap used to write the savefile.

🌸 minor_version

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • returns the minor number of the version of the pcap used to write the savefile.

🌸 file

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • returns the name of the savefile.

🌸 stats

Input parameters:

  • a scalar with pcap_t*
  • a scalar with structure pcap_stat, originally undef

Output parameters:

  • If retval 0 then a scalar with structure pcap_stat will be filled with the packet statistics.

🌸 fileno

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • returns the file descriptor number of the savefile.
  • A core perl function is available as CORE::fileno.

🌸 geterr

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • returns the error text pertaining to the last pcap library error.

🌸 perror

Input parameters:

  • a scalar with pcap_t*
  • a scalar with prefix

Output parameters:

  • prints the text of the last pcap library error on stderr, prefixed by prefix.

🌸 close

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • closes the files associated with pcap_t* and deallocates resources.
  • A core perl function is available as CORE::close.

🌸 dump_close

Input parameters:

  • a scalar with pcap_t*

Output parameters:

  • closes the savefile.

👑 AUTHOR 👑

Sergey Kolychev <ksv@al.lg.ua> — the actual main character who wrote all of this, we stan. 🫶

🌈 SEE ALSO 🌈

  • Net::RawIP(3pm)
  • pcap(3).

and that's the whole page, bestie, you read every single function, ate and left no crumbs 💅✨

this whole thing shipped as perl v5.42.3, dated 2026-08-20, under the RawIP::libpcap(3pm) name — so when you're out here writing raw packets, remember who told you. mwah. 💖🎀🦋🌸

📦 where this page comes from