úÎù'ìâ±      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§¨©ª«¬­®¯° non-portable experimentalbos@serpentine.comȱ²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓDatalink types. 8This covers all of the datalink types defined in bpf.h. * Types defined on your system may vary. &IEEE 802.15.4, exactly as in the spec  716 MAC Common Part Sublayer with radiotap radio header ,Per Packet Information encapsulated packets *IEEE 802.15.4, with address fields padded $Controller Area Network (CAN) v2.0B /USB packets, beginning with a Linux USB header %IEEE 802.16 MAC Common Part Sublayer  Multi Link Frame Relay (FRF.16) .Bluetooth HCI UART transport layer (part H:4)  USB packet 0ARINC 653 Interpartition Communication messages  ARINC 429 Raw LAPD for vISDN (not generic LAPD) GPF-F (ITU-T G.7041/Y.1303) GPF-T (ITU-T G.7041/Y.1303)  GPRS LLC  Outgoing packets for ppp daemon Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use !Reserved for private use "Linux IrDA packet #DOCSIS MAC frame $ SS7, C7 SCCP %'SS7, C7 Message Transfer Part 3 (MPT3) &'SS7, C7 Message Transfer Part 2 (MPT2) ' SS7, C7 MTP2 with pseudo-header (Apple IP-over-IEEE 1394 )Linux ARCNET header * 311 plus a number of bits of link-layer information +(Full Frontal ATM on Solaris with SunATM ,RFC 2625 IP-over-Fibre Channel -Siemens HiPath HDLC . Aironet (Cisco) 802.11 wireless /!Intersil Prism II wireless chips 0 Cisco IOS 1OpenBSD's pflog 2OpenBSD's old ipfilter 3 Acorn Econet 4Apple LocalTalk 5Linux cooked sockets 6Encapsulated packets for IPsec 7OpenBSD loopback device 8 Frame Relay 9IEEE 802.11 wireless : Cisco HDLC ;Symantec Enterprise Firewall <PPP over ethernet =(PPP over serial with HDLC encapsulation >Redback SmartEdge 400/800 ?Linux classical IP over ATM @BSD OS point-to-point protocol ABSD OS serial line IP Braw IP CLLC SNAP encapsulated ATM DFDDI EPoint-to-point protocol FSerial line IP GARCNET HIEEE 802 networks IChaos JProteon ProNET Token Ring Kamateur radio AX.25 L$original 3 Mbit per second ethernet M(10 Mbit per second (or faster) ethernet Nunknown encapsulation Ono link layer encapsulation ÔP,the type of the callback function passed to ‡ or ˆ. Q8The direction in which packets are to be captured. See  „. Routgoing packets Sincoming packets T+incoming and outgoing packets (the default ÕÖ×ØU=The network address record. Both the address and mask are in  network byte order. VWIPv4 network address X IPv4 netmask Y=The socket address record. Note that this is not the same as  SockAddr from Network.Socket!. (That is a Haskell version of C's  struct sockaddr_in. This is the real struct sockaddr from the  BSD network stack.) Z[-an address family exported by Network.Socket \]The address structure. ^_interface address ` network mask abroadcast address b*address of peer, of a point-to-point link cThe interface structure. dethe interface name f&interface description string (if any) g-address families supported by this interface hÙijkpackets received lpackets dropped by libpcap m)packets dropped by the network interface noptimestamp (seconds) qtimestamp (microseconds) r#number of bytes present in capture snumber of bytes on the wire tdump file descriptor upacket capture descriptor ÚvÛw(Compiled Berkeley Packet Filter program xÜÝyy0 opens a dump file for reading. The file format  is the same as used by tcpdump and Wireshark. The string "-"  is a synonym for stdin.  filename zz8 is used to get a packet descriptor that can be used to D look at packets on the network. The arguments are the device name, B the snapshot legnth (in bytes), the promiscuity of the interface  (Þ0 == promiscuous) and a timeout in milliseconds. Using "any"2 as the device name will capture packets from all 0 interfaces. On some systems, reading from the "any" device is D incompatible with setting the interfaces into promiscuous mode. In C that case, only packets whose link layer addresses match those of  the interfaces are captured.  device name snapshot length set to promiscuous mode? timeout in milliseconds {{4 is used to get a packet capture descriptor without ? opening a file or device. It is typically used to test packet  filter compilation by }". The arguments are the link type  and the snapshot length. datalink type snapshot length packet capture descriptor ||2 opens a dump file for writing. This dump file is  written to by the Š* function. The arguments are a raw packet , capture descriptor and the file name, with "-" as a synonym for  stdout. packet capture descriptor dump file name davefile descriptor }?Set a filter on the specified packet capture descriptor. Valid & filter strings are those accepted by tcpdump. packet capture descriptor filter string  optimize? IPv4 network mask ~?Compile a filter for use by another program using the Berkeley  Packet Filter library. snapshot length datalink type filter string  optimize? IPv4 network mask 4 returns the name of a device suitable for use with  z and (. If you only have one interface, it is % the function of choice. If not, see €. €€4 returns a list of all the network devices that can  be opened by z). It returns only those devices that the B calling process has sufficient privileges to open, so it may not " find every device on the system. ßàáâ@Return the network address and mask for the specified interface 5 name. Only valid for IPv4. For other protocols, use €  and search the dc' list for the associated network mask.  device name ‚>Set a packet capture descriptor into non-blocking mode if the  second argument is Þ*, otherwise put it in blocking mode. Note @ that the packet capture descriptor must have been obtaine from  z. ƒ1Return the blocking status of the packet capture  descriptor. Þ" indicates that the descriptor is = non-blocking. Descriptors referring to dump files opened by  | always return ã. „;Specify the direction in which packets are to be captured. < Complete functionality is not necessarily available on all  platforms. äå…1Send a raw packet through the network interface. *packet data (including link-level header)  packet size †æ‡BCollect and process packets. The arguments are the packet capture 0 descriptor, the count and a callback function. =The count is the maximum number of packets to process before E returning. A count of -1 means process all of the packets received > in one buffer (if a live capture) or all of the packets in a  dump file (if offline). ?The callback function is passed two arguments, a packet header * record and a pointer to the packet data ( Ptr Word8). THe header D record contains the number of bytes captured, whcih can be used to ( marshal the data into a list or array. packet capture descriptor number of packets to process packet processing function number of packets read ˆ Similar to ‡', but loop until the number of packets C specified by the second argument are read. A negative value loops  forever. CThis function does not return when a live read tiemout occurs. Use  ‡+ instead if you wnat to specify a timeout. packet capture descriptor number of packet to read packet processing function number of packets read ‰,Read the next packet (equivalent to calling ‡ with a  count of 1). packet capture descriptor *packet header and data of the next packet ŠAWrite the packet data given by the second and third arguments to  a dump file opened by {. Š is designed so it can be / easily used as a default callback function by ‡ or ˆ. dump file descriptor packet header record  packet data ‹9Returns the datalink type associated with the given pcap  descriptor. Œ4Sets the datalink type for a given pcap descriptor. 0List all the datalink types supported by a pcap D descriptor. Entries from the resulting list are valid arguments to  Œ. Ž>Returns the number of packets received, the number of packets C dropped by the packet filter and the number of packets dropped by 9 the interface (before processing by the packet filter). AVersion of the library. The returned pair consists of the major  and minor version numbers.  returns Þ! if the current dump file uses a 9 different byte order than the one native to the system. ‘1The snapshot length that was used in the call to z. çè’  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’vutwxPQTSRONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!  cdefgh]^_`abYZ[\UVWXnopqrsijklmyz{|}~€‚ƒ„‹Œ‡ˆ‰Š…†Ž‘’OONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!    !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQTSRRSTUVWXVWXYZ[\Z[\]^_`ab^_`abcdefghdefghijklmjklmnopqrsopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘ non-portable experimentalbos@serpentine.com$’callback using é for packet body “dump file handle ê”packet capture handle ë••0 opens a dump file for reading. The file format  is the same as used by tcpdump and Wireshark. The string "-"  is a synonym for stdin. name of dump file to read –– is used to get a ” that can be used to look C at packets on the network. The arguments are the device name, the > snapshot length (in bytes), the promiscuity of the interface  (Þ0 == promiscuous) and a timeout in microseconds. AThe timeout allows the packet filter to delay while accumulating D multiple packets, which is more efficient than reading packets one 7 by one. A timeout of zero will wait indefinitely for "enough"  packets to arrive. Using "any"2 as the device name will capture packets from all 0 interfaces. On some systems, reading from the "any" device is D incompatible with setting the interfaces into promiscuous mode. In C that case, only packets whose link layer addresses match those of  the interfaces are captured.  device name snapshot length #set interface to promiscuous mode? timeout in microseconds —— is used to get a ” without opening a file C or device. It is typically used to test packet filter compilation  by ™3. The arguments are the link type and the snapshot  length. datalink type snapshot length ì혘2 opens a dump file for writing. This dump file is  written to by the ¨ function. packet capture handle name of dump file to write to ™;Set a filter on the specified packet capture handle. Valid & filter strings are those accepted by tcpdump. handle on which to set filter filter string  optimize? IPv4 network mask šSet the given ”& into non-blocking mode if the second  argument is Þ/, otherwise put it in blocking mode. Note that  the ” must have been obtained from –. must have been obtained from – set/unset blocking mode ›"Return the blocking status of the ”. Þ indicates B that the handle is non-blocking. Handles referring to dump files  opened by ˜ always return ã. œ;Specify the direction in which packets are to be captured. < Complete functionality is not necessarily available on all  platforms. EGet the timestamp of a packet as a single quantity, in microseconds. ž#Get the timestamp of a packet as a î. ïWrap a callback that expects a é so that it is  usable as a regular P. ŸCollect and process packets. =The count is the maximum number of packets to process before E returning. A count of -1 means process all of the packets received > in one buffer (if a live capture) or all of the packets in a  dump file (if offline). ?The callback function is passed two arguments, a packet header * record and a pointer to the packet data ( Ptr Word8). THe header D record contains the number of bytes captured, whcih can be used to ) marshal the data into a list, array, or é (using  ¥). number of packets to process packet processing function number of packets read   Variant of Ÿ for use with é. number of packets to process packet processing function number of packets read ¡ Similar to Ÿ', but loop until the number of packets C specified by the second argument are read. A negative value loops  forever. CThis function does not return when a live read tiemout occurs. Use  Ÿ+ instead if you wnat to specify a timeout. /number of packets to read (-1 == loop forever) packet processing function number of packets read ¢ Variant of ¡ for use with é. /number of packets to read (-1 == loop forever) packet processing function number of packets read £1Send a raw packet through the network interface. *packet data (including link-level header)  packet size ¤ Variant of £ for use with é. *packet data (including link-level header) ¥!Represent a captured packet as a é. Suitable for  use as is with the result of ¦ , or use ð ¥ inside  a P with Ÿ. ¦,Read the next packet (equivalent to calling Ÿ with a  count of 1). §¨AWrite the packet data given by the second and third arguments to  a dump file opened by —. ¨ is designed so it can be / easily used as a default callback function by Ÿ or ¡. packet header record  packet data ©packet header record  packet data ª<Returns the datalink type associated with the given handle. «-Sets the datalink type for the given handle. ¬3List all the datalink types supported by the given @ handle. Entries from the resulting list are valid arguments to  «. ­>Returns the number of packets received, the number of packets C dropped by the packet filter and the number of packets dropped by 9 the interface (before processing by the packet filter). ®AVersion of the library. The returned pair consists of the major  and minor version numbers. ¯¯ returns Þ! if the current dump file uses a 9 different byte order than the one native to the system. °1The snapshot length that was used in the call to –. ˜  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrsw~€’“”•–—˜™š›œžŸ ¡¢£¤¥¦§¨©ª«¬­®¯°˜”“wP’QTSRONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!  cdefgh]^_`abYZ[\UVWXnopqrsijklm•–—˜™~€š›œª«¬Ÿ¡¦¨ ¢§©£¤¥ž­®¯°’“”•–—˜™š›œžŸ ¡¢£¤¥¦§¨©ª«¬­®¯°ñ      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXXYZ[[\]^^_`abccdefghhijkllmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘vwxyz€’“„”…•‚–—†˜‡™ˆ‰Š‹ŒŽš›œžŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¾¿¿ÀrsuÁÂÃÄÅÆÇÈÂÃÉÊËÌÍÎÏÐÑ‘ÒÓÔÕÖ×ØÙÚÛ pcap-0.4.3Network.Pcap.Base Network.PcapLinkDLT_IEEE802_15_4DLT_IEEE802_16_MAC_CPS_RADIODLT_PPIDLT_IEEE802_15_4_LINUX DLT_CAN20B DLT_USB_LINUXDLT_IEEE802_16_MAC_CPSDLT_MFRDLT_BLUETOOTH_HCI_H4DLT_USB DLT_A653_ICMDLT_A429DLT_LINUX_LAPD DLT_GPF_F DLT_GPF_T DLT_GPRS_LLC DLT_PPP_PPPD DLT_USER15 DLT_USER14 DLT_USER13 DLT_USER12 DLT_USER11 DLT_USER10 DLT_USER9 DLT_USER8 DLT_USER7 DLT_USER6 DLT_USER5 DLT_USER4 DLT_USER3 DLT_USER2 DLT_USER1 DLT_USER0DLT_LINUX_IRDA DLT_DOCSISDLT_SCCPDLT_MTP3DLT_MTP2DLT_MTP2_WITH_PHDRDLT_APPLE_IP_OVER_IEEE1394DLT_ARCNET_LINUXDLT_IEEE802_11_RADIO DLT_SUNATMDLT_IP_OVER_FC DLT_HHDLCDLT_AIRONET_HEADERDLT_PRISM_HEADER DLT_CISCO_IOS DLT_PFLOG DLT_IPFILTER DLT_ECONET DLT_LTALK DLT_LINUX_SLLDLT_ENCDLT_LOOP DLT_FRELAYDLT_IEEE802_11 DLT_C_HDLCDLT_SYMANTEC_FIREWALL DLT_PPP_ETHERDLT_PPP_SERIALDLT_REDBACK_SMARTEDGE DLT_ATM_CLIP DLT_PPP_BSDOSDLT_SLIP_BSDOSDLT_RAWDLT_ATM_RFC1483DLT_FDDIDLT_PPPDLT_SLIP DLT_ARCNET DLT_IEEE802 DLT_CHAOS DLT_PRONETDLT_AX25 DLT_EN3MB DLT_EN10MB DLT_UNKNOWNDLT_NULLCallback DirectionOutInInOutNetworknetAddrnetMaskSockAddrsaFamilysaAddrPcapAddraddrSAaddrMask addrBcastaddrPeer InterfaceifName ifDescription ifAddressesifFlags Statistics statReceived statDroppedstatIfaceDroppedPktHdr hdrSeconds hdrUsecondshdrCaptureLength hdrWireLengthPdump PcapDumpTagPcapTag BpfProgram BpfProgramTag openOfflineopenLiveopenDeadopenDump setFilter compileFilter lookupDev findAllDevs lookupNet setNonBlock getNonBlock setDirection sendPackettoPktHdrdispatchloopnextdumpdatalink setDatalink listDatalinks statisticsversion isSwapped snapshotLen CallbackBS DumpHandle PcapHandlehdrTime hdrDiffTime dispatchBSloopBS sendPacketBStoBSnextBSdumpBS pcap_snapshotpcap_is_swappedpcap_minor_versionpcap_major_version pcap_statspcap_list_datalinkspcap_set_datalink pcap_datalink pcap_dump pcap_next pcap_loop pcap_dispatchexportCCallbackpcap_sendpacket pcap_geterrpcap_setdirectionpcap_getnonblockpcap_setnonblockpcap_lookupnetpcap_freealldevspcap_findalldevspcap_lookupdevh2c'' pcap_freecodepcap_setfilterpcap_compile_nopcap pcap_compileh2c'pcap_dump_closepcap_dump_openh2cpcap_open_deadpcap_open_live pcap_closepcap_open_offline CCallbackDevAddrDevBufErrBuf withErrBufghc-primGHC.BoolTrue devs2listoneDev addrs2listoneAddrFalse packDirection throwPcapIfexportCallbackpackLink unpackLinkbytestring-0.9.1.7Data.ByteString.Internal ByteStringwithPcapwithDump time-1.1.4Data.Time.Clock.ScaleDiffTimewrapBSbase Data.Tuplecurry