base/bif/pcap.bif.bro

GLOBAL

Pcap

Namespaces:GLOBAL, Pcap Source File:/scripts/base/bif/pcap.bif.bro

Summary

Functions

Pcap::error: function	Returns a string representation of the last PCAP error.
Pcap::install_pcap_filter: function	Installs a PCAP filter that has been precompiled with Pcap::precompile_pcap_filter.
Pcap::precompile_pcap_filter: function	Precompiles a PCAP filter and binds it to a given identifier.

Detailed Interface

Functions

Pcap::error

Type:function () : string

Returns a string representation of the last PCAP error.

Returns:A descriptive error message of the PCAP function that failed.

See also: Pcap::precompile_pcap_filter, Pcap::install_pcap_filter, install_src_addr_filter, install_src_net_filter, uninstall_src_addr_filter, uninstall_src_net_filter, install_dst_addr_filter, install_dst_net_filter, uninstall_dst_addr_filter, uninstall_dst_net_filter

Pcap::install_pcap_filter

Type:function (id: PcapFilterID) : bool

Installs a PCAP filter that has been precompiled with Pcap::precompile_pcap_filter.

Id:The PCAP filter id of a precompiled filter. Returns:True if the filter associated with id has been installed successfully.

See also: Pcap::precompile_pcap_filter, install_src_addr_filter, install_src_net_filter, uninstall_src_addr_filter, uninstall_src_net_filter, install_dst_addr_filter, install_dst_net_filter, uninstall_dst_addr_filter, uninstall_dst_net_filter, Pcap::error

Pcap::precompile_pcap_filter

Type:function (id: PcapFilterID, s: string) : bool

Precompiles a PCAP filter and binds it to a given identifier.

Id:The PCAP identifier to reference the filter s later on. S:The PCAP filter. See man tcpdump for valid expressions. Returns:True if s is valid and precompiles successfully.

See also: Pcap::install_pcap_filter, install_src_addr_filter, install_src_net_filter, uninstall_src_addr_filter, uninstall_src_net_filter, install_dst_addr_filter, install_dst_net_filter, uninstall_dst_addr_filter, uninstall_dst_net_filter, Pcap::error