The plokami Reference Manual

Table of Contents

The plokami Reference Manual

This is the plokami Reference Manual, version 1.5, generated automatically by Declt version 2.4 "Will Decker" on Wed Jun 20 12:24:17 2018 GMT+0.

1 Introduction

PLOKAMI is a lispy interface to libpcap built on top of a CFFI portability
layer. Complete bindings to every function in libpcap are in pcap.lisp
and a higher level interface in plokami.lisp.

* Features
  - Realtime network packet capture
  - Injection
  - PCAP dumpfile read/write
  - BPF
  - Timeouts and operation in non-blocking mode
  - Full support for Windows through WinPCAP

The library has been tested on SBCL (linux/darwin), ClozureCL and 
LispWorks (darwin/win32) but should work on every platform that 
CFFI supports.

* Performance
Minimal overhead over plain libpcap.

* License
The code comes with a BSD-style license so you can basically do with it
whatever you want.

* Documentation
[[http://atomontage.github.com/plokami]]

* Author
xristos (AT) sdf (DOT) lonestar (DOT) org

2 Systems

The main system appears first, followed by any subsystem dependency.

2.1 plokami

Author

xristos@sdf.lonestar.org

Description

Common Lisp PCAP interface.

Version

1.5

Dependency

cffi

Source

plokami.asd (file)

Components

• packages.lisp (file)
• pcap.lisp (file)
• plokami.lisp (file)
• utils.lisp (file)

3 Files

Files are sorted by type and then listed depth-first from the systems components trees.

3.1 Lisp

3.1.1 plokami.asd

Location

plokami.asd

Systems

plokami (system)

Packages

plokami-asd

3.1.2 plokami/packages.lisp

Parent

plokami (system)

Location

packages.lisp

Packages

plokami

3.1.3 plokami/pcap.lisp

Dependency

packages.lisp (file)

Parent

plokami (system)

Location

pcap.lisp

Exported Definitions

*pcap-version* (special variable)

Internal Definitions

• %inet-ntop (function)
• %link-ntoa (function)
• %memcpy (function)
• %pcap-breakloop (function)
• %pcap-close (function)
• %pcap-compile (function)
• %pcap-datalink (function)
• %pcap-datalink-name-to-val (function)
• %pcap-datalink-val-to-description (function)
• %pcap-datalink-val-to-name (function)
• %pcap-dispatch (function)
• %pcap-dump (function)
• %pcap-dump-close (function)
• %pcap-dump-flush (function)
• %pcap-dump-ftell (function)
• %pcap-dump-open (function)
• %pcap-fileno (function)
• %pcap-findalldevs (function)
• %pcap-freealldevs (function)
• %pcap-freecode (function)
• %pcap-get-selectable-fd (function)
• %pcap-geterr (function)
• %pcap-getnonblock (function)
• %pcap-inject (function)
• %pcap-is-swapped (function)
• %pcap-lib-version (function)
• %pcap-list-datalinks (function)
• %pcap-lookupdev (function)
• %pcap-lookupnet (function)
• %pcap-loop (function)
• %pcap-major-version (function)
• %pcap-minor-version (function)
• %pcap-next (function)
• %pcap-next-ex (function)
• %pcap-open-dead (function)
• %pcap-open-live (function)
• %pcap-open-offline (function)
• %pcap-perror (function)
• %pcap-sendpacket (function)
• %pcap-set-datalink (function)
• %pcap-setdirection (function)
• %pcap-setfilter (function)
• %pcap-setnonblock (function)
• %pcap-snapshot (function)
• %pcap-stats (function)
• %pcap-strerror (function)
• *supported-datalinks* (special variable)
• +dlt_802_11+ (constant)
• +dlt_en10mb+ (constant)
• +dlt_null+ (constant)
• +dlt_ppp+ (constant)
• +dlt_ppp_bsdos1+ (constant)
• +dlt_ppp_bsdos2+ (constant)
• +dlt_ppp_ether+ (constant)
• +dlt_ppp_pppd+ (constant)
• +dlt_ppp_serial+ (constant)
• +dlt_slip+ (constant)
• +dlt_usb_linux+ (constant)
• +error-buffer-size+ (constant)
• +pcap_if_loopback+ (constant)
• bpf_insn-tclass (class)
• bpf_program-tclass (class)
• pcap_addr_t-tclass (class)
• pcap_if_t-tclass (class)
• pcap_pkthdr-tclass (class)
• pcap_stat-tclass (class)
• sockaddr-tclass (class)
• timeval-tclass (class)

3.1.4 plokami/plokami.lisp

Dependency

pcap.lisp (file)

Parent

plokami (system)

Location

plokami.lisp

Exported Definitions

• block-mode-error (condition)
• capture (generic function)
• capture (method)
• capture-file-read-error (condition)
• capture-file-write-error (condition)
• dump (generic function)
• dump (method)
• find-all-devs (function)
• inject (generic function)
• inject (method)
• make-pcap-live (function)
• make-pcap-reader (function)
• make-pcap-writer (function)
• network-interface-error (condition)
• packet-capture-error (condition)
• packet-filter-error (condition)
• packet-inject-error (condition)
• pcap-live-alive-p (method)
• pcap-live-datalink (method)
• pcap-live-descriptor (method)
• pcap-live-interface (method)
• pcap-live-promisc-p (method)
• pcap-live-snaplen (method)
• pcap-live-timeout (method)
• pcap-reader-alive-p (method)
• pcap-reader-datalink (method)
• pcap-reader-file (method)
• pcap-reader-major (method)
• pcap-reader-minor (method)
• pcap-reader-snaplen (method)
• pcap-reader-swapped-p (method)
• pcap-writer-alive-p (method)
• pcap-writer-datalink (method)
• pcap-writer-file (method)
• pcap-writer-snaplen (method)
• plokami-error (condition)
• plokami-error-text (method)
• set-filter (generic function)
• set-filter (method)
• set-filter (method)
• set-non-block (generic function)
• set-non-block (method)
• set-non-block (method)
• stats (generic function)
• stats (method)
• stop (generic function)
• stop (method)
• stop (method)
• stop (method)
• with-pcap-interface (macro)
• with-pcap-reader (macro)
• with-pcap-writer (macro)

Internal Definitions

• *callbacks* (special variable)
• *compile-mutex* (special variable)
• *concurrent-pcap* (special variable)
• *concurrent-pcap-mutex* (special variable)
• clear-error-buffer (function)
• error-buffer-to-lisp (function)
• free-error-buffer (function)
• make-error-buffer (function)
• pcap-live (class)
• pcap-mixin (class)
• pcap-process-mixin (class)
• pcap-reader (class)
• pcap-writer (class)
• with-error-buffer (macro)

3.1.5 plokami/utils.lisp

Dependency

plokami.lisp (file)

Parent

plokami (system)

Location

utils.lisp

4 Packages

Packages are listed by definition order.

4.1 plokami-asd

Source

plokami.asd

Use List

• asdf/interface
• common-lisp

4.2 plokami

Source

packages.lisp (file)

Use List

• cffi
• common-lisp

Exported Definitions

• *pcap-version* (special variable)
• block-mode-error (condition)
• capture (generic function)
• capture (method)
• capture-file-read-error (condition)
• capture-file-write-error (condition)
• dump (generic function)
• dump (method)
• find-all-devs (function)
• inject (generic function)
• inject (method)
• make-pcap-live (function)
• make-pcap-reader (function)
• make-pcap-writer (function)
• network-interface-error (condition)
• packet-capture-error (condition)
• packet-filter-error (condition)
• packet-inject-error (condition)
• pcap-live-alive-p (generic function)
• pcap-live-alive-p (method)
• pcap-live-datalink (generic function)
• pcap-live-datalink (method)
• pcap-live-descriptor (generic function)
• pcap-live-descriptor (method)
• pcap-live-interface (generic function)
• pcap-live-interface (method)
• pcap-live-promisc-p (generic function)
• pcap-live-promisc-p (method)
• pcap-live-snaplen (generic function)
• pcap-live-snaplen (method)
• pcap-live-timeout (generic function)
• pcap-live-timeout (method)
• pcap-reader-alive-p (generic function)
• pcap-reader-alive-p (method)
• pcap-reader-datalink (generic function)
• pcap-reader-datalink (method)
• pcap-reader-file (generic function)
• pcap-reader-file (method)
• pcap-reader-major (generic function)
• pcap-reader-major (method)
• pcap-reader-minor (generic function)
• pcap-reader-minor (method)
• pcap-reader-snaplen (generic function)
• pcap-reader-snaplen (method)
• pcap-reader-swapped-p (generic function)
• pcap-reader-swapped-p (method)
• pcap-writer-alive-p (generic function)
• pcap-writer-alive-p (method)
• pcap-writer-datalink (generic function)
• pcap-writer-datalink (method)
• pcap-writer-file (generic function)
• pcap-writer-file (method)
• pcap-writer-snaplen (generic function)
• pcap-writer-snaplen (method)
• plokami-error (condition)
• plokami-error-text (generic function)
• plokami-error-text (method)
• set-filter (generic function)
• set-filter (method)
• set-filter (method)
• set-non-block (generic function)
• set-non-block (method)
• set-non-block (method)
• stats (generic function)
• stats (method)
• stop (generic function)
• stop (method)
• stop (method)
• stop (method)
• with-pcap-interface (macro)
• with-pcap-reader (macro)
• with-pcap-writer (macro)

Internal Definitions

• %inet-ntop (function)
• %link-ntoa (function)
• %memcpy (function)
• %pcap-breakloop (function)
• %pcap-close (function)
• %pcap-compile (function)
• %pcap-datalink (function)
• %pcap-datalink-name-to-val (function)
• %pcap-datalink-val-to-description (function)
• %pcap-datalink-val-to-name (function)
• %pcap-dispatch (function)
• %pcap-dump (function)
• %pcap-dump-close (function)
• %pcap-dump-flush (function)
• %pcap-dump-ftell (function)
• %pcap-dump-open (function)
• %pcap-fileno (function)
• %pcap-findalldevs (function)
• %pcap-freealldevs (function)
• %pcap-freecode (function)
• %pcap-get-selectable-fd (function)
• %pcap-geterr (function)
• %pcap-getnonblock (function)
• %pcap-inject (function)
• %pcap-is-swapped (function)
• %pcap-lib-version (function)
• %pcap-list-datalinks (function)
• %pcap-lookupdev (function)
• %pcap-lookupnet (function)
• %pcap-loop (function)
• %pcap-major-version (function)
• %pcap-minor-version (function)
• %pcap-next (function)
• %pcap-next-ex (function)
• %pcap-open-dead (function)
• %pcap-open-live (function)
• %pcap-open-offline (function)
• %pcap-perror (function)
• %pcap-sendpacket (function)
• %pcap-set-datalink (function)
• %pcap-setdirection (function)
• %pcap-setfilter (function)
• %pcap-setnonblock (function)
• %pcap-snapshot (function)
• %pcap-stats (function)
• %pcap-strerror (function)
• *callbacks* (special variable)
• *compile-mutex* (special variable)
• *concurrent-pcap* (special variable)
• *concurrent-pcap-mutex* (special variable)
• *supported-datalinks* (special variable)
• +dlt_802_11+ (constant)
• +dlt_en10mb+ (constant)
• +dlt_null+ (constant)
• +dlt_ppp+ (constant)
• +dlt_ppp_bsdos1+ (constant)
• +dlt_ppp_bsdos2+ (constant)
• +dlt_ppp_ether+ (constant)
• +dlt_ppp_pppd+ (constant)
• +dlt_ppp_serial+ (constant)
• +dlt_slip+ (constant)
• +dlt_usb_linux+ (constant)
• +error-buffer-size+ (constant)
• +pcap_if_loopback+ (constant)
• bpf_insn-tclass (class)
• bpf_program-tclass (class)
• clear-error-buffer (function)
• error-buffer-to-lisp (function)
• free-error-buffer (function)
• make-error-buffer (function)
• pcap-live (class)
• pcap-mixin (class)
• pcap-process-mixin (class)
• pcap-reader (class)
• pcap-writer (class)
• pcap_addr_t-tclass (class)
• pcap_if_t-tclass (class)
• pcap_pkthdr-tclass (class)
• pcap_stat-tclass (class)
• sockaddr-tclass (class)
• timeval-tclass (class)
• with-error-buffer (macro)

5 Definitions

Definitions are sorted by export status, category, package, and then by lexicographic order.

5.1 Exported definitions

5.1.1 Special variables

Special Variable: *pcap-version*

Version of native libpcap library.

Package

plokami

Source

pcap.lisp (file)

5.1.2 Macros

Macro: with-pcap-interface (LIVE IFACE &rest OPTIONS) &body BODY

Call ‘MAKE-PCAP-LIVE’ using IFACE, OPTIONS as arguments and store
the resulting instance in LIVE. Forms in body are wrapped in an ‘UNWIND-PROTECT’ form that takes care of deallocating resources on error and also returns packet capture statistics when possible. A restart is also automatically invoked when ‘PACKET-FILTER-ERROR’ is signaled, skipping the filter setup.

Package

plokami

Source

plokami.lisp (file)

Macro: with-pcap-reader (READER FILE &rest OPTIONS) &body BODY

Call ‘MAKE-PCAP-READER’ using FILE, OPTIONS as arguments and store the resulting instance in READER. Forms in body are wrapped in an UNWIND-PROTECT form that takes care of deallocating resources on error. A restart is also automatically invoked when ‘PACKET-FILTER-ERROR’ is signaled,
skipping the filter setup.

Package

plokami

Source

plokami.lisp (file)

Macro: with-pcap-writer (WRITER FILE &rest OPTIONS) &body BODY

Call ‘MAKE-PCAP-WRITER’ using FILE, OPTIONS as arguments and store the resulting instance in WRITER. Forms in body are wrapped in an ‘UNWIND-PROTECT’ form that takes care of deallocating resources on error.

Package

plokami

Source

plokami.lisp (file)

5.1.3 Functions

Function: find-all-devs ()

Return a list of all network devices that can be opened for capture. Result list mirrors layout explained in pcap_findalldevs(3). NIL is returned when no interfaces are available, possibly due to permission issues.
Signals ‘NETWORK-INTERFACE-ERROR’ on errors.

Package

plokami

Source

plokami.lisp (file)

Function: make-pcap-live INTERFACE &key PROMISC NBIO TIMEOUT SNAPLEN

Creates and returns a ‘PCAP-LIVE’ instance that is used for live packet capture from a network interface.

INTERFACE is a string that defines the network interface to use for capture. PROMISC should be T for promiscuous mode, NIL otherwise.
NBIO should be T when non-blocking operation is required. NIL otherwise (default). TIMEOUT should hold read timeout in milliseconds.
0 will wait forever. Only used when in blocking mode and only in platforms that support it. No guarantee of actually returning within TIMEOUT is made. Use non-blocking mode if that is not adequate. SNAPLEN should contain the number of bytes captured per packet. Default is 68 which should be enough for headers. ‘NETWORK-INTERFACE-ERROR’ or ‘BLOCK-MODE-ERROR’ is signaled on errors.

Package

plokami

Source

plokami.lisp (file)

Function: make-pcap-reader FILE &key SNAPLEN

Creates and returns a ‘PCAP-READER’ instance that is used for reading packets from a pcap dumpfile.

FILE is the filename to open and read packets from. SNAPLEN should contain the number of bytes read per packet captured. Default is 68 which should be enough for headers. ‘CAPTURE-FILE-READ-ERROR’ is signaled on errors.

Package

plokami

Source

plokami.lisp (file)

Function: make-pcap-writer FILE &key DATALINK SNAPLEN

Creates and returns a ‘PCAP-WRITER’ instance that is used to write packets to a pcap dumpfile.

FILE is the filename to open and write packets to. DATALINK should contain a string that represents the datalink protocol of the network interface used to capture the packets. Default is Ethernet. SNAPLEN should contain the number of bytes read per packet captured and should be the same as the one used when capturing/reading the packets.
‘CAPTURE-FILE-WRITE-ERROR’ is signaled on errors.

Package

plokami

Source

plokami.lisp (file)

5.1.4 Generic functions

Generic Function: capture PCAP-PROCESS-MIXIN PACKETS HANDLER

Only works for ‘PCAP-LIVE’ or ‘PCAP-READER’ instances.
Captures and processes maximum number of PACKETS. Minimum is
zero. Return 0 when no packets available (did not pass installed packet filter, end of file for dumpfiles, read timeout expired before packets arrive,
no packets available at the time of the call if in non-blocking-mode) otherwise return number of packets processed which can be fewer than the maximum given in PACKETS (due to internal libpcap buffer).

A count of -1 in PACKETS processes all the packets received so far when live capturing, or all the packets in a file when reading a pcap dumpfile.

Handler must be a user defined function that accepts five arguments and will get called once for every packet received. The values passed are SEC, USEC, CAPLEN, LEN and BUFFER. SEC and USEC correspond to
seconds/microseconds since the UNIX epoch (timeval structure in C) at the time of capture. CAPLEN corresponds to the number of bytes captured. LEN corresponds to the number of bytes originally present in the packet but not necessarily captured. BUFFER is a statically allocated byte vector (via ‘CFFI:MAKE-SHAREABLE-BYTE-VECTOR’) with the contents of the captured packet. This means that successive calls of the packet handler will overwrite its contents and if packet persistence is required, contents of BUFFER should be copied somewhere else from within HANDLER.

If an error occurs, ‘PACKET-CAPTURE-ERROR’ is signaled for live
interfaces and ‘CAPTURE-FILE-READ-ERROR’ for pcap dumpfiles (reading).
For more details on callback handling, see CFFI callback ‘PCAP-HANDLER’.

Package

plokami

Source

plokami.lisp (file)

Methods

Method: capture (CAP pcap-process-mixin) (PACKETS integer) (PHANDLER function)

Generic Function: dump PCAP-WRITER DATA SEC USEC &key LENGTH ORIGLENGTH

Writes contents of byte vector DATA to ‘PCAP-WRITER’
instance (which corresponds to a pcap dumpfile). LENGTH is the number of bytes to write and is set to the size of DATA when omitted. ORIGLENGTH should be set to the number of bytes originally present in the packet and is set to LENGTH when omitted. SEC and USEC should be set to seconds/microseconds since the UNIX epoch at the time of capture (timeval structure in C).
If you are using your own source buffer (instead of the one used by PLOKAMI), it should be allocated with ‘CFFI:MAKE-SHAREABLE-BYTE-VECTOR’. As LIBPCAP does not return useful value on pcap_dump() no PLOKAMI specific conditions, beyond simple assertions of argument checks, are raised by this function.

Package

plokami

Source

plokami.lisp (file)

Methods

Method: dump (WRITER pcap-writer) (BUFFER vector) (SEC integer) (USEC integer) &key LENGTH ORIGLENGTH

Generic Function: inject PCAP-LIVE BUFFER &key LENGTH

Injects LENGTH bytes to a live pcap interface
(size of BUFFER if omitted). Return number of bytes injected on success.
For performance reasons BUFFER should be a byte vector allocated with ‘CFFI:MAKE-SHAREABLE-BYTE-VECTOR’. ‘PACKET-INJECT-ERROR’ is signaled on failure.

Package

plokami

Source

plokami.lisp (file)

Methods

Method: inject (CAP pcap-live) (BUFFER vector) &key LENGTH

Generic Function: pcap-live-alive-p OBJECT

Package

plokami

Methods

Method: pcap-live-alive-p (PCAP-LIVE pcap-live)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-live-datalink OBJECT

Package

plokami

Methods

Method: pcap-live-datalink (PCAP-LIVE pcap-live)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-live-descriptor OBJECT

Package

plokami

Methods

Method: pcap-live-descriptor (PCAP-LIVE pcap-live)

File descriptor that can be used with epoll/kqueue/select.

Source

plokami.lisp (file)

Generic Function: pcap-live-interface OBJECT

Package

plokami

Methods

Method: pcap-live-interface (PCAP-LIVE pcap-live)

Interface to capture packets from.

Source

plokami.lisp (file)

Generic Function: pcap-live-promisc-p OBJECT

Package

plokami

Methods

Method: pcap-live-promisc-p (PCAP-LIVE pcap-live)

True if capturing in promiscuous mode.

Source

plokami.lisp (file)

Generic Function: pcap-live-snaplen OBJECT

Package

plokami

Methods

Method: pcap-live-snaplen (PCAP-LIVE pcap-live)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-live-timeout OBJECT

Package

plokami

Methods

Method: pcap-live-timeout (PCAP-LIVE pcap-live)

Read timeout in milliseconds. 0 will wait forever.
Only works in blocking mode/platforms that support it. No guarantee of returning within timeout.

Source

plokami.lisp (file)

Generic Function: pcap-reader-alive-p OBJECT

Package

plokami

Methods

Method: pcap-reader-alive-p (PCAP-READER pcap-reader)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-reader-datalink OBJECT

Package

plokami

Methods

Method: pcap-reader-datalink (PCAP-READER pcap-reader)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-reader-file OBJECT

Package

plokami

Methods

Method: pcap-reader-file (PCAP-READER pcap-reader)

File to read packets from.

Source

plokami.lisp (file)

Generic Function: pcap-reader-major OBJECT

Package

plokami

Methods

Method: pcap-reader-major (PCAP-READER pcap-reader)

Major version of savefile.

Source

plokami.lisp (file)

Generic Function: pcap-reader-minor OBJECT

Package

plokami

Methods

Method: pcap-reader-minor (PCAP-READER pcap-reader)

Minor version of savefile.

Source

plokami.lisp (file)

Generic Function: pcap-reader-snaplen OBJECT

Package

plokami

Methods

Method: pcap-reader-snaplen (PCAP-READER pcap-reader)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-reader-swapped-p OBJECT

Package

plokami

Methods

Method: pcap-reader-swapped-p (PCAP-READER pcap-reader)

Savefile uses different byte order from host system.

Source

plokami.lisp (file)

Generic Function: pcap-writer-alive-p OBJECT

Package

plokami

Methods

Method: pcap-writer-alive-p (PCAP-WRITER pcap-writer)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-writer-datalink OBJECT

Package

plokami

Methods

Method: pcap-writer-datalink (PCAP-WRITER pcap-writer)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: pcap-writer-file OBJECT

Package

plokami

Methods

Method: pcap-writer-file (PCAP-WRITER pcap-writer)

File to write packets to.

Source

plokami.lisp (file)

Generic Function: pcap-writer-snaplen OBJECT

Package

plokami

Methods

Method: pcap-writer-snaplen (PCAP-WRITER pcap-writer)

automatically generated reader method

Source

plokami.lisp (file)

Generic Function: plokami-error-text CONDITION

Package

plokami

Methods

Method: plokami-error-text (CONDITION plokami-error)

Source

plokami.lisp (file)

Generic Function: set-filter PCAP-PROCESS-MIXIN STRING

Sets a packet filter on a ‘PCAP-LIVE’ or ‘PCAP-READER’
instance. The filter should be given as a bpf expression in STRING. ‘PACKET-FILTER-ERROR’ is signaled on failure. A restart, ‘CONTINUE-NO-FILTER’ is installed that can be invoked to continue on error.

Package

plokami

Source

plokami.lisp (file)

Methods

Method: set-filter (CAP pcap-reader) (FILTER string)

Method: set-filter (CAP pcap-live) (FILTER string)

Generic Function: set-non-block PCAP-LIVE BLOCK-MODE

Sets non-blocking mode if BLOCK-MODE is T, blocking
mode if NIL. ‘BLOCK-MODE-ERROR’ is signaled on failure and a restart, ‘CONTINUE-BLOCK-MODE’ is installed, that can be invoked to continue.

Package

plokami

Source

plokami.lisp (file)

Methods

Method: set-non-block (CAP pcap-live) (BLOCK-MODE (eql nil))

Method: set-non-block (CAP pcap-live) (BLOCK-MODE (eql t))

Generic Function: stats PCAP-LIVE

Returns packet capture statistics from the start of the run
to the time of the call for live interface capture only. Statistics are returned as multiple values and correspond to packets received, packets dropped and packets dropped by interface (in this order). ‘NETWORK-INTERFACE-ERROR’ is signaled on failure.

Package

plokami

Source

plokami.lisp (file)

Methods

Method: stats (CAP pcap-live)

Generic Function: stop PCAP-MIXIN

Deallocates resources for ‘PCAP-LIVE’, ‘PCAP-READER’, ‘PCAP-WRITER’ instance.

Package

plokami

Source

plokami.lisp (file)

Method Combination

progn (short method combination)

Options: :most-specific-first

Methods

Method: stop (CAP pcap-writer) progn

Method: stop (CAP pcap-process-mixin) progn

Method: stop (CAP pcap-mixin) progn

5.1.5 Conditions

Condition: block-mode-error ()

Signaled on error when changing blocking mode.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

plokami-error (condition)

Condition: capture-file-read-error ()

Signaled on all pcap readfile errors.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

plokami-error (condition)

Condition: capture-file-write-error ()

Signaled on all pcap dumpfile errors.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

plokami-error (condition)

Condition: network-interface-error ()

Signaled on all network interface errors.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

plokami-error (condition)

Condition: packet-capture-error ()

Signaled on error during live packet capture.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

plokami-error (condition)

Condition: packet-filter-error ()

Signaled when a berkeley packet filter could not be established.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

plokami-error (condition)

Condition: packet-inject-error ()

Signaled on errors during packet injection.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

plokami-error (condition)

Condition: plokami-error ()

Generic condition for this package.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

error (condition)

Direct subclasses

• network-interface-error (condition)
• capture-file-read-error (condition)
• capture-file-write-error (condition)
• packet-filter-error (condition)
• packet-capture-error (condition)
• packet-inject-error (condition)
• block-mode-error (condition)

Direct methods

plokami-error-text (method)

Direct slots

Slot: text

Initargs

:text

Readers

plokami-error-text (generic function)

5.2 Internal definitions

5.2.1 Constants

Constant: +dlt_802_11+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_en10mb+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_null+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_ppp+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_ppp_bsdos1+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_ppp_bsdos2+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_ppp_ether+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_ppp_pppd+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_ppp_serial+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_slip+

Package

plokami

Source

pcap.lisp (file)

Constant: +dlt_usb_linux+

Package

plokami

Source

pcap.lisp (file)

Constant: +error-buffer-size+

Package

plokami

Source

pcap.lisp (file)

Constant: +pcap_if_loopback+

Package

plokami

Source

pcap.lisp (file)

5.2.2 Special variables

Special Variable: *callbacks*

Package

plokami

Source

plokami.lisp (file)

Special Variable: *compile-mutex*

Package

plokami

Source

plokami.lisp (file)

Special Variable: *concurrent-pcap*

Package

plokami

Source

plokami.lisp (file)

Special Variable: *concurrent-pcap-mutex*

Package

plokami

Source

plokami.lisp (file)

Special Variable: *supported-datalinks*

Package

plokami

Source

pcap.lisp (file)

5.2.3 Macros

Macro: with-error-buffer (ERROR-BUFFER) &body BODY

Package

plokami

Source

plokami.lisp (file)

5.2.4 Functions

Function: %inet-ntop AF SRC DST SIZE

Package

plokami

Source

pcap.lisp (file)

Function: %link-ntoa SDL

Package

plokami

Source

pcap.lisp (file)

Function: %memcpy DST SRC LEN

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-breakloop PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-close PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-compile PCAP_T FP STR OPTIMIZE NETMASK

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-datalink PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-datalink-name-to-val NAME

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-datalink-val-to-description DLT

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-datalink-val-to-name DLT

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-dispatch PCAP_T CNT CALLBACK USER

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-dump USER HEADER SP

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-dump-close DUMPER

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-dump-flush DUMPER

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-dump-ftell DUMPER

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-dump-open PCAP_T FNAME

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-fileno PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-findalldevs ALLDEVSP ERRBUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-freealldevs ALLDEVS

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-freecode FP

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-get-selectable-fd PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-geterr PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-getnonblock PCAP_T ERRBUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-inject PCAP_T BUF SIZE

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-is-swapped PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-lib-version ()

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-list-datalinks PCAP_T DLT_BUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-lookupdev ERRBUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-lookupnet DEVICE NETP MASKP ERRBUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-loop PCAP_T CNT CALLBACK USER

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-major-version PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-minor-version PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-next PCAP_T HEADER

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-next-ex PCAP_T HEADERP DATAP

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-open-dead LINKTYPE SNAPLEN

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-open-live DEVICE SNAPLEN PROMISC TO_MS ERRBUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-open-offline FILENAME ERRBUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-perror PCAP_T PREFIX

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-sendpacket PCAP_T BUF SIZE

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-set-datalink PCAP_T DLT

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-setdirection PCAP_T D

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-setfilter PCAP_T FP

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-setnonblock PCAP_T NONBLOCK ERRBUF

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-snapshot PCAP_T

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-stats PCAP_T PS

Package

plokami

Source

pcap.lisp (file)

Function: %pcap-strerror ERROR

Package

plokami

Source

pcap.lisp (file)

Function: clear-error-buffer FOREIGN-BUFFER

Set FOREIGN-BUFFER to the empty string.

Package

plokami

Source

plokami.lisp (file)

Function: error-buffer-to-lisp FOREIGN-BUFFER

Return FOREIGN-BUFFER as a lisp string.

Package

plokami

Source

plokami.lisp (file)

Function: free-error-buffer FOREIGN-BUFFER

Free memory held by FOREIGN-BUFFER.

Package

plokami

Source

plokami.lisp (file)

Function: make-error-buffer ()

Allocate and return foreign char array to hold error string.

Package

plokami

Source

plokami.lisp (file)

5.2.5 Classes

Class: bpf_insn-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Class: bpf_program-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Class: pcap-live ()

Class for live packet capture.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

• pcap-mixin (class)
• pcap-process-mixin (class)

Direct methods

• set-filter (method)
• inject (method)
• stats (method)
• set-non-block (method)
• set-non-block (method)
• initialize-instance (method)
• pcap-live-snaplen (method)
• pcap-live-datalink (method)
• pcap-live-alive-p (method)
• pcap-live-descriptor (method)
• pcap-live-timeout (method)
• pcap-live-promisc-p (method)
• pcap-live-interface (method)

Direct slots

Slot: interface

Interface to capture packets from.

Initargs

:if

Readers

pcap-live-interface (generic function)

Slot: promisc

True if capturing in promiscuous mode.

Initargs

:promisc

Readers

pcap-live-promisc-p (generic function)

Slot: non-block

True if pcap descriptor is in non-blocking mode.

Initargs

:nbio

Slot: timeout

Read timeout in milliseconds. 0 will wait forever.
Only works in blocking mode/platforms that support it. No guarantee of returning within timeout.

Initargs

:timeout

Initform

100

Readers

pcap-live-timeout (generic function)

Slot: descriptor

File descriptor that can be used with epoll/kqueue/select.

Readers

pcap-live-descriptor (generic function)

Slot: live

Readers

pcap-live-alive-p (generic function)

Slot: datalink

Readers

pcap-live-datalink (generic function)

Slot: snaplen

Initargs

:snaplen

Readers

pcap-live-snaplen (generic function)

Class: pcap-mixin ()

Internal class used as a mixin for all classes with pcap functionality.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

standard-object (class)

Direct subclasses

• pcap-live (class)
• pcap-reader (class)
• pcap-writer (class)

Direct methods

stop (method)

Direct slots

Slot: pcap_t

Foreign pointer to pcap structure.

Slot: datalink

Datalink protocol for this device.

Slot: snaplen

How many bytes to capture per packet received.

Initform

68

Slot: live

Packet capture object is live.

Class: pcap-process-mixin ()

Internal class, mixed in packet processing (‘PCAP-LIVE’, ‘PCAP-READER’).

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

standard-object (class)

Direct subclasses

• pcap-live (class)
• pcap-reader (class)

Direct methods

• capture (method)
• stop (method)

Direct slots

Slot: buffer

Packet buffer to hold captured packets.

Slot: handler

Lisp packet handler for capture. Invoked by callback.

Slot: hashkey

Hashtable key for this instance.

Slot: hashkey-pointer

Foreign pointer to hashkey, passed in callback.

Class: pcap-reader ()

Class for reading packets from a dumpfile.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

• pcap-mixin (class)
• pcap-process-mixin (class)

Direct methods

• set-filter (method)
• initialize-instance (method)
• pcap-reader-snaplen (method)
• pcap-reader-datalink (method)
• pcap-reader-alive-p (method)
• pcap-reader-minor (method)
• pcap-reader-major (method)
• pcap-reader-swapped-p (method)
• pcap-reader-file (method)

Direct slots

Slot: file

File to read packets from.

Initargs

:file

Initform

(error "must supply filename to read packets from.")

Readers

pcap-reader-file (generic function)

Slot: swapped

Savefile uses different byte order from host system.

Readers

pcap-reader-swapped-p (generic function)

Slot: major

Major version of savefile.

Readers

pcap-reader-major (generic function)

Slot: minor

Minor version of savefile.

Readers

pcap-reader-minor (generic function)

Slot: live

Readers

pcap-reader-alive-p (generic function)

Slot: datalink

Readers

pcap-reader-datalink (generic function)

Slot: snaplen

Initargs

:snaplen

Readers

pcap-reader-snaplen (generic function)

Class: pcap-writer ()

Class for writing packets to a dumpfile.

Package

plokami

Source

plokami.lisp (file)

Direct superclasses

pcap-mixin (class)

Direct methods

• dump (method)
• initialize-instance (method)
• stop (method)
• pcap-writer-snaplen (method)
• pcap-writer-alive-p (method)
• pcap-writer-datalink (method)
• pcap-writer-file (method)

Direct slots

Slot: file

File to write packets to.

Initargs

:file

Initform

(error "must supply file to write packets to.")

Readers

pcap-writer-file (generic function)

Slot: dumper

Foreign packet dumper object.

Slot: datalink

Initargs

:datalink

Initform

"en10mb"

Readers

pcap-writer-datalink (generic function)

Slot: live

Readers

pcap-writer-alive-p (generic function)

Slot: snaplen

Initargs

:snaplen

Readers

pcap-writer-snaplen (generic function)

Class: pcap_addr_t-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Class: pcap_if_t-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Class: pcap_pkthdr-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Class: pcap_stat-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Class: sockaddr-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Class: timeval-tclass ()

Package

plokami

Source

pcap.lisp (file)

Direct superclasses

• translatable-foreign-type (class)
• foreign-struct-type (class)

Appendix A Indexes

A.1 Concepts

A.2 Functions

A.3 Variables