base/bif/pcap.bif.bro
- GLOBAL
| Namespace: | GLOBAL |
|---|---|
| Source File: | /scripts/base/bif/pcap.bif.bro |
Summary
Functions
| install_pcap_filter: function | Installs a PCAP filter that has been precompiled with precompile_pcap_filter. |
| pcap_error: function | Returns a string representation of the last PCAP error. |
| precompile_pcap_filter: function | Precompiles a PCAP filter and binds it to a given identifier. |
Detailed Interface
Functions
- install_pcap_filter
Type : function (id: PcapFilterID) : bool Installs a PCAP filter that has been precompiled with precompile_pcap_filter.
Id : The PCAP filter id of a precompiled filter. Returns : True if the filter associated with id has been installed successfully. See also: precompile_pcap_filter, install_src_addr_filter, install_src_net_filter, uninstall_src_addr_filter, uninstall_src_net_filter, install_dst_addr_filter, install_dst_net_filter, uninstall_dst_addr_filter, uninstall_dst_net_filter, pcap_error
- pcap_error
Type : function () : string Returns a string representation of the last PCAP error.
Returns : A descriptive error message of the PCAP function that failed. See also: precompile_pcap_filter, install_pcap_filter, install_src_addr_filter, install_src_net_filter, uninstall_src_addr_filter, uninstall_src_net_filter, install_dst_addr_filter, install_dst_net_filter, uninstall_dst_addr_filter, uninstall_dst_net_filter
- precompile_pcap_filter
Type : function (id: PcapFilterID, s: string) : bool Precompiles a PCAP filter and binds it to a given identifier.
Id : The PCAP identifier to reference the filter s later on. S : The PCAP filter. See man tcpdump for valid expressions. Returns : True if s is valid and precompiles successfully. See also: install_pcap_filter, install_src_addr_filter, install_src_net_filter, uninstall_src_addr_filter, uninstall_src_net_filter, install_dst_addr_filter, install_dst_net_filter, uninstall_dst_addr_filter, uninstall_dst_net_filter, pcap_error
