NGREP-LIB(3)

NAME
ngrep-lib - network grep library

DESCRIPTION
The ngrep library is a front-end for accessing the Packet Capture Library (libpcap) without going through the hassle of programming the filters, making sure you pick the right size for the header etc.

USAGE
Needed include-files are: #include <pcap.h>
#include <ngrep-lib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include <net/if_arp.h>
#include <arpa/inet.h>
These are the functions to access the library: void ngrep_callback_arp(void *my_arp);
void ngrep_callback_ip(void *my_ip);
void ngrep_callback_tcp(void *my_tcp);
void ngrep_callback_udp(void *my_udp);
void ngrep_callback_icmp(void *my_icmp);
void ngrep_callback_process(void *my_ip, void *my_tcp, void *my_udp, void *my_icmp); This function initializes the callback functions for ngrep. They can be NULL, in which case there is no callback. ngrep_callback_process is defined for historical reasons. void ngrep_callback_info(void *my_info, void *my_stats); This function initializes the callback functions for info. The first is actually the same first lines with the output of ngrep, with the interface, filter, match and output information. The second is the output at the end where you get the amount of received and dropped packets. void ngrep_setfilter(char *bpffilter, char *matchexpression, char *options); This function initializes the filter, the match expression and the options. The parameters are the same as you use them on the command line for ngrep. For example: ngrep_setfilter("port 4000 or icmp",NULL,"-d tun0"); void ngrep_run(void); This function runs ngrep. void ngrep_main(char *bpffilter, char *match, char *options); This function is the same as calling ngrep_setfilter() and ngrep_run();

CALLBACK FUNCTIONS
void my_ip(struct ip *iphdr); This callback function has one parameter: the IP header. This one should be used as the first parameter with ngrep_callback_process(). It will be called when an IP packet has arrived during ngrep_run(). void my_tcp(struct ip *iphdr, struct tcphdr *tcphdr, char *data,int len); void my_udp(struct ip *iphdr, struct udphdr *udphdr, char *data,int len); void my_icmp(struct ip *iphdr, struct icmp *icmphdr, char *data,int len); void my_arp(struct arphdr *arphdr); These callback functions have four parameters: the IP header, the TCP/UDP or ICMP header, the data and the size of the data. These should be used as the second, third or fourth parameter of ngrep_callback_process(). These will be called when TCP, UDP or ICMP packets have arrived during ngrep_run(). void my_info(char *interface, char *filter, char *match, char *output); This callback function is called during ngrep_setfilter() with information regarding the filters set by ngrep_setfilter(). void my_stats(long received, long dropped); This callback function is called after ngrep_run() has finished. It contains some statistical information. See test-lib.c for how to use them.

LINKING
Use -lngrep -lpcap to link the executable.

OPTIONS
See the man-page of ngrep(8) for the syntax of the options, match and bpffilter. The only option removed is -q (quiet), that's now done via the info and stats callback function.

AUTHOR
ngrep written by Jordan Ritter <jpr5@darkridge.com>. ngrep-library written by Edwin Groothuis <edwin@mavetju.org>.

REPORTING BUGS
Send bug reports to the author.

BUGS
At this moment, the maximum number of total spaces in the parameters passed to ngrep_main() is 95. The ARP callback function is only used for Ethernet networks.

SEE ALSO
pcap(3), ngrep(8)