|author||Guy Harris <firstname.lastname@example.org>||2009-09-07 16:23:15 -0700|
|committer||Guy Harris <email@example.com>||2009-09-07 16:23:15 -0700|
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev.
Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
Diffstat (limited to 'pcap_stats.3pcap')
1 files changed, 44 insertions, 4 deletions
diff --git a/pcap_stats.3pcap b/pcap_stats.3pcap
index abc56f8..a953e21 100644
@@ -19,7 +19,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-.TH PCAP_SNAPSHOT 3PCAP "5 April 2008"
+.TH PCAP_STATS 3PCAP "7 September 2009"
pcap_stats \- get capture statistics
@@ -35,17 +35,57 @@ int pcap_stats(pcap_t *p, struct pcap_stat *ps);
fills in the
-structure pointed to by its second argument. The values represent
+.B struct pcap_stat
+pointed to by its second argument. The values represent
packet statistics from the start of the run to the time of the call.
is supported only on live captures, not on ``savefiles''; no statistics
are stored in ``savefiles'', so no statistics are available when reading
from a ``savefile''.
+.B struct pcap_stat
+has the following members:
+number of packets received;
+number of packets dropped because there was no room in the operating
+system's buffer when they arrived, because packets weren't being read
+number of packets dropped by the network interface or its driver.
+The statistics do not behave the same way on all platforms.
+might count packets whether they passed any filter set with
+.BR pcap_setfilter (3PCAP)
+or not, or it might count only packets that pass the filter.
+It also might, or might not, count packets dropped because there was no
+room in the operating system's buffer when they arrived.
+is not available on all platforms; it is zero on platforms where it's
+not available. If packet filtering is done in libpcap, rather than in
+the operating system, it would count packets that don't pass the filter.
+might, or might not, count packets not yet read from the operating
+system and thus not yet seen by the application.
+might, or might not, be implemented; if it's zero, that might mean that
+no packets were dropped by the interface, or it might mean that the
+statistic is unavailable, so it should not be treated as an indication
+that the interface did not drop any packets.
.SH RETURN VALUE
-returns 0 on success and returns \-1 if there is an error or the
+returns 0 on success and returns \-1 if there is an error or if
doesn't support packet statistics.
If \-1 is returned,