<      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ non-portable experimentalbos@serpentine.com Safe-InferedDatalink types. ?This covers all of the datalink types defined in bpf.h. Types $ defined on your system may vary. &IEEE 802.15.4, exactly as in the spec  716 MAC Common Part Sublayer with radiotap radio header ,Per Packet Information encapsulated packets *IEEE 802.15.4, with address fields padded $Controller Area Network (CAN) v2.0B /USB packets, beginning with a Linux USB header %IEEE 802.16 MAC Common Part Sublayer  Multi Link Frame Relay (FRF.16) .Bluetooth HCI UART transport layer (part H:4)  USB packet 0ARINC 653 Interpartition Communication messages  ARINC 429 Raw LAPD for vISDN (not generic LAPD) GPF-F (ITU-T G.7041/Y.1303) GPF-T (ITU-T G.7041/Y.1303)  GPRS LLC  Outgoing packets for ppp daemon Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use Reserved for private use !Reserved for private use "Reserved for private use #Linux IrDA packet $DOCSIS MAC frame % SS7, C7 SCCP &'SS7, C7 Message Transfer Part 3 (MPT3) ''SS7, C7 Message Transfer Part 2 (MPT2) ( SS7, C7 MTP2 with pseudo-header )Apple IP-over-IEEE 1394 *Linux ARCNET header + 311 plus a number of bits of link-layer information ,(Full Frontal ATM on Solaris with SunATM -RFC 2625 IP-over-Fibre Channel .Siemens HiPath HDLC / Aironet (Cisco) 802.11 wireless 0!Intersil Prism II wireless chips 1 Cisco IOS 2OpenBSD's pflog 3OpenBSD's old ipfilter 4 Acorn Econet 5Apple LocalTalk 6Linux cooked sockets 7Encapsulated packets for IPsec 8OpenBSD loopback device 9 Frame Relay :IEEE 802.11 wireless ; Cisco HDLC <Symantec Enterprise Firewall =PPP over ethernet >(PPP over serial with HDLC encapsulation ?Redback SmartEdge 400/800 @Linux classical IP over ATM ABSD OS point-to-point protocol BBSD OS serial line IP Craw IP DLLC SNAP encapsulated ATM EFDDI FPoint-to-point protocol GSerial line IP HARCNET IIEEE 802 networks JChaos KProteon ProNET Token Ring Lamateur radio AX.25 M$original 3 Mbit per second ethernet N(10 Mbit per second (or faster) ethernet Ounknown encapsulation Pno link layer encapsulation Q,the type of the callback function passed to  or . R8The direction in which packets are to be captured. See  . Soutgoing packets Tincoming packets U,incoming and outgoing packets (the default) V=The network address record. Both the address and mask are in  network byte order. XIPv4 network address Y IPv4 netmask Z=The socket address record. Note that this is not the same as  SockAddr from !. (That is a Haskell version of C's  struct sockaddr_in. This is the real struct sockaddr from the  BSD network stack.) \-an address family exported by Network.Socket ^The address structure. `interface address a network mask bbroadcast address c*address of peer, of a point-to-point link dThe interface structure. fthe interface name g&interface description string (if any) h-address families supported by this interface lpackets received mpackets dropped by libpcap n)packets dropped by the network interface qtimestamp (seconds) rtimestamp (microseconds) s#number of bytes present in capture tnumber of bytes on the wire uDump file descriptor. vPacket capture descriptor. x)Compiled Berkeley Packet Filter program. zz3 opens a dump file for reading. The file format is  the same as used by tcpdump and Wireshark. The string "-" is  a synonym for stdin. {{8 is used to get a packet descriptor that can be used to D look at packets on the network. The arguments are the device name, B the snapshot length (in bytes), the promiscuity of the interface  (0 == promiscuous) and a timeout in milliseconds. Using "any"2 as the device name will capture packets from all 0 interfaces. On some systems, reading from the "any" device is D incompatible with setting the interfaces into promiscuous mode. In C that case, only packets whose link layer addresses match those of  the interfaces are captured. ||4 is used to get a packet capture descriptor without ? opening a file or device. It is typically used to test packet  filter compilation by ~". The arguments are the link type  and the snapshot length. }}2 opens a dump file for writing. This dump file is  written to by the * function. The arguments are a raw packet , capture descriptor and the file name, with "-" as a synonym for  stdout. ~?Set a filter on the specified packet capture descriptor. Valid & filter strings are those accepted by tcpdump. ?Compile a filter for use by another program using the Berkeley  Packet Filter library. 4 returns the name of a device suitable for use with  { and (. If you only have one interface, it is % the function of choice. If not, see . 4 returns a list of all the network devices that can  be opened by {). It returns only those devices that the B calling process has sufficient privileges to open, so it may not " find every device on the system. @Return the network address and mask for the specified interface 5 name. Only valid for IPv4. For other protocols, use   and search the d' list for the associated network mask. >Set a packet capture descriptor into non-blocking mode if the  second argument is *, otherwise put it in blocking mode. Note A that the packet capture descriptor must have been obtained from  {. 1Return the blocking status of the packet capture  descriptor. " indicates that the descriptor is = non-blocking. Descriptors referring to dump files opened by  } always return . ;Specify the direction in which packets are to be captured. < Complete functionality is not necessarily available on all  platforms. 1Send a raw packet through the network interface. BCollect and process packets. The arguments are the packet capture 0 descriptor, the count and a callback function. =The count is the maximum number of packets to process before E returning. A count of -1 means process all of the packets received C in one buffer (if a live capture) or all of the packets in a dump  file (if offline). ?The callback function is passed two arguments, a packet header * record and a pointer to the packet data ( Ptr Word8). The header D record contains the number of bytes captured, which can be used to ( marshal the data into a list or array.  Similar to ', but loop until the number of packets C specified by the second argument are read. A negative value loops  forever. CThis function does not return when a live read timeout occurs. Use  + instead if you want to specify a timeout. ,Read the next packet (equivalent to calling  with a  count of 1). AWrite the packet data given by the second and third arguments to  a dump file opened by |.  is designed so it can be / easily used as a default callback function by  or . 9Returns the datalink type associated with the given pcap  descriptor. 4Sets the datalink type for a given pcap descriptor. <List all the datalink types supported by a pcap descriptor. 8 Entries from the resulting list are valid arguments to  . >Returns the number of packets received, the number of packets C dropped by the packet filter and the number of packets dropped by 9 the interface (before processing by the packet filter). AVersion of the library. The returned pair consists of the major  and minor version numbers.  returns ! if the current dump file uses a 9 different byte order than the one native to the system. 1The snapshot length that was used in the call to {.   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz filename { device name snapshot length set to promiscuous mode? timeout in milliseconds |datalink type snapshot length packet capture descriptor }packet capture descriptor dump file name savefile descriptor ~packet capture descriptor filter string  optimize? IPv4 network mask snapshot length datalink type filter string  optimize? IPv4 network mask  device name *packet data (including link-level header)  packet size packet capture descriptor number of packets to process packet processing function number of packets read packet capture descriptor number of packet to read packet processing function number of packets read packet capture descriptor *packet header and data of the next packet dump file descriptor packet header record  packet data   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~wvuxyQRUTSPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!  defghi^_`abcZ[\]VWXYopqrstjklmnz{|}~'PPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!  QRUTSVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ non-portable experimentalbos@serpentine.com Safe-InferedCallback using  for packet body. Dump file handle. Packet capture handle. 3 opens a dump file for reading. The file format is  the same as used by tcpdump and Wireshark. The string "-" is  a synonym for stdin.  is used to get a  that can be used to look C at packets on the network. The arguments are the device name, the > snapshot length (in bytes), the promiscuity of the interface  (0 == promiscuous) and a timeout in microseconds. AThe timeout allows the packet filter to delay while accumulating D multiple packets, which is more efficient than reading packets one 7 by one. A timeout of zero will wait indefinitely for "enough"  packets to arrive. Using "any"2 as the device name will capture packets from all 0 interfaces. On some systems, reading from the "any" device is D incompatible with setting the interfaces into promiscuous mode. In C that case, only packets whose link layer addresses match those of  the interfaces are captured.  is used to get a  without opening a file C or device. It is typically used to test packet filter compilation  by 3. The arguments are the link type and the snapshot  length. 2 opens a dump file for writing. This dump file is  written to by the  function. BSet a filter on the specified packet capture handle. Valid filter  strings are those accepted by tcpdump. Set the given & into non-blocking mode if the second  argument is /, otherwise put it in blocking mode. Note that  the  must have been obtained from . "Return the blocking status of the .  indicates B that the handle is non-blocking. Handles referring to dump files  opened by  always return . ;Specify the direction in which packets are to be captured. < Complete functionality is not necessarily available on all  platforms. 7Get the timestamp of a packet as a single quantity, in  microseconds. #Get the timestamp of a packet as a . Collect and process packets. =The count is the maximum number of packets to process before E returning. A count of -1 means process all of the packets received C in one buffer (if a live capture) or all of the packets in a dump  file (if offline). ?The callback function is passed two arguments, a packet header * record and a pointer to the packet data ( Ptr Word8). THe header D record contains the number of bytes captured, which can be used to ) marshal the data into a list, array, or  (using  ).  Variant of  for use with .  Similar to ', but loop until the number of packets C specified by the second argument are read. A negative value loops  forever. CThis function does not return when a live read timeout occurs. Use  + instead if you want to specify a timeout.  Variant of  for use with . 1Send a raw packet through the network interface.  Variant of  for use with . !Represent a captured packet as a . Suitable for  use as is with the result of  , or use   inside  a Q with . ,Read the next packet (equivalent to calling  with a  count of 1). AWrite the packet data given by the second and third arguments to  a dump file opened by .  is designed so it can be / easily used as a default callback function by  or . <Returns the datalink type associated with the given handle. -Sets the datalink type for the given handle. 3List all the datalink types supported by the given @ handle. Entries from the resulting list are valid arguments to  . >Returns the number of packets received, the number of packets C dropped by the packet filter and the number of packets dropped by 9 the interface (before processing by the packet filter). AVersion of the library. The returned pair consists of the major  and minor version numbers.  returns ! if the current dump file uses a 9 different byte order than the one native to the system. 1The snapshot length that was used in the call to . name of dump file to read  device name snapshot length #set interface to promiscuous mode? timeout in microseconds datalink type snapshot length packet capture handle name of dump file to write to handle on which to set filter filter string  optimize? IPv4 network mask must have been obtained from  set/unset blocking mode number of packets to process packet processing function number of packets read number of packets to process packet processing function number of packets read /number of packets to read (-1 == loop forever) packet processing function number of packets read /number of packets to read (-1 == loop forever) packet processing function number of packets read *packet data (including link-level header)  packet size *packet data (including link-level header) packet header record  packet data packet header record  packet data   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstxxQRUTSPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!  defghi^_`abcZ[\]VWXYopqrstjklmn      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]]^_``abcdeefghijjklmnnopqrstuvwxyz{|}~xyz{| pcap-0.4.5.2Network.Pcap.Base Network.PcapNetworkSocketLink DLT_PFSYNCDLT_IEEE802_15_4DLT_IEEE802_16_MAC_CPS_RADIODLT_PPIDLT_IEEE802_15_4_LINUX DLT_CAN20B DLT_USB_LINUXDLT_IEEE802_16_MAC_CPSDLT_MFRDLT_BLUETOOTH_HCI_H4DLT_USB DLT_A653_ICMDLT_A429DLT_LINUX_LAPD DLT_GPF_F DLT_GPF_T DLT_GPRS_LLC DLT_PPP_PPPD DLT_USER15 DLT_USER14 DLT_USER13 DLT_USER12 DLT_USER11 DLT_USER10 DLT_USER9 DLT_USER8 DLT_USER7 DLT_USER6 DLT_USER5 DLT_USER4 DLT_USER3 DLT_USER2 DLT_USER1 DLT_USER0DLT_LINUX_IRDA DLT_DOCSISDLT_SCCPDLT_MTP3DLT_MTP2DLT_MTP2_WITH_PHDRDLT_APPLE_IP_OVER_IEEE1394DLT_ARCNET_LINUXDLT_IEEE802_11_RADIO DLT_SUNATMDLT_IP_OVER_FC DLT_HHDLCDLT_AIRONET_HEADERDLT_PRISM_HEADER DLT_CISCO_IOS DLT_PFLOG DLT_IPFILTER DLT_ECONET DLT_LTALK DLT_LINUX_SLLDLT_ENCDLT_LOOP DLT_FRELAYDLT_IEEE802_11 DLT_C_HDLCDLT_SYMANTEC_FIREWALL DLT_PPP_ETHERDLT_PPP_SERIALDLT_REDBACK_SMARTEDGE DLT_ATM_CLIP DLT_PPP_BSDOSDLT_SLIP_BSDOSDLT_RAWDLT_ATM_RFC1483DLT_FDDIDLT_PPPDLT_SLIP DLT_ARCNET DLT_IEEE802 DLT_CHAOS DLT_PRONETDLT_AX25 DLT_EN3MB DLT_EN10MB DLT_UNKNOWNDLT_NULLCallback DirectionOutInInOutnetAddrnetMaskSockAddrsaFamilysaAddrPcapAddraddrSAaddrMask addrBcastaddrPeer InterfaceifName ifDescription ifAddressesifFlags Statistics statReceived statDroppedstatIfaceDroppedPktHdr hdrSeconds hdrUsecondshdrCaptureLength hdrWireLengthPdump PcapDumpTagPcapTag BpfProgram BpfProgramTag openOfflineopenLiveopenDeadopenDump setFilter compileFilter lookupDev findAllDevs lookupNet setNonBlock getNonBlock setDirection sendPackettoPktHdrdispatchloopnextdumpdatalink setDatalink listDatalinks statisticsversion isSwapped snapshotLen CallbackBS DumpHandle PcapHandlehdrTime hdrDiffTime dispatchBSloopBS sendPacketBStoBSnextBSdumpBSghc-prim GHC.TypesTrueFalsebytestring-0.9.2.1Data.ByteString.Internal ByteStringtime-1.4Data.Time.Clock.ScaleDiffTimebase Data.Tuplecurry