`libpcapnav` Manual
Prev |  | Next

# Introduction

Welcome! You're looking at the manual for `libpcapnav`. Thanks for reading this.

# What is `libpcapnav`?

`libpcapnav` is a `libpcap` wrapper library that allows navigation to arbitrary locations in a `tcpdump` trace file between reads. The API is intentionally much like that of the pcap library. You can navigate in trace files both in time and space: you can jump to a packet which is at appr. 2/3 of the trace, or you can jump as closely as possible to a packet with a given timestamp, and then read packets from there. In addition, the API provides convenience functions for manipulating timeval structures.

Like `libpcap`, this library handles things through an opaque handle struct. For trace file navigation and reading packets, this handle is enough. If you need to apply BPF filters or write packets to disk, you can access the familiar pcap handle that is used internally.

Prev | Home | Next
`libpcapnav` Manual |  | How does it work?