-- Hoogle documentation, generated by Haddock
-- See Hoogle, http://www.haskell.org/hoogle/


-- | A system-independent interface for user-level packet capture
--   
--   A system-independent interface for user-level packet capture
@package pcap
@version 0.4.5.2


-- | The <a>Base</a> module is a low-level binding to all of the functions
--   in <tt>libpcap</tt>. See <a>http://www.tcpdump.org</a> for more
--   information.
--   
--   Only a minimum of marshaling is done. For a higher-level interface
--   that's more friendly, use the <a>Pcap</a> module.
--   
--   To convert captured packet data to a list, extract the length of the
--   captured buffer from the packet header record and use <a>peekArray</a>
--   to convert the captured data to a list. For illustration:
--   
--   <pre>
--   import Foreign
--   import Network.Pcap.Base
--   
--   main :: IO ()
--   main = do
--       p &lt;- openLive "eth0" 100 True 10000
--       withForeignPtr p $ \ptr -&gt;
--         dispatch ptr (-1) printIt
--       return ()
--   
--   printIt :: PktHdr -&gt; Ptr Word8 -&gt; IO ()
--   printIt ph bytep =
--       peekArray (fromIntegral (hdrCaptureLength ph)) bytep &gt;&gt;= print
--   </pre>
--   
--   Note that the <a>SockAddr</a> exported here is not the
--   <tt>SockAddr</tt> from <a>Socket</a>. The <tt>SockAddr</tt> from
--   <a>Socket</a> corresponds to <tt>struct sockaddr_in</tt> in BSD
--   terminology. The <a>SockAddr</a> record here is BSD's <tt>struct
--   sockaddr</tt>. See W.R.Stevens, TCP Illustrated, volume 2, for further
--   elucidation.
--   
--   This binding should be portable across systems that can use the
--   <tt>libpcap</tt> library from <tt>tcpdump.org</tt>. It will not work
--   with Winpcap, a similar library for Windows, although adapting it
--   should not prove difficult.
module Network.Pcap.Base
data PcapTag

-- | Packet capture descriptor.
data PcapDumpTag

-- | Dump file descriptor.
type Pdump = ForeignPtr PcapDumpTag

-- | Compiled Berkeley Packet Filter program.
type BpfProgram = ForeignPtr BpfProgramTag
data BpfProgramTag

-- | the type of the callback function passed to <a>dispatch</a> or
--   <a>loop</a>.
type Callback = PktHdr -> Ptr Word8 -> IO ()

-- | The direction in which packets are to be captured. See
--   <a>setDirection</a>.
data Direction

-- | incoming and outgoing packets (the default)
InOut :: Direction

-- | incoming packets
In :: Direction

-- | outgoing packets
Out :: Direction

-- | Datalink types.
--   
--   This covers all of the datalink types defined in bpf.h. Types defined
--   on your system may vary.
data Link

-- | no link layer encapsulation
DLT_NULL :: Link

-- | unknown encapsulation
DLT_UNKNOWN :: Int -> Link

-- | 10 Mbit per second (or faster) ethernet
DLT_EN10MB :: Link

-- | original 3 Mbit per second ethernet
DLT_EN3MB :: Link

-- | amateur radio AX.25
DLT_AX25 :: Link

-- | Proteon ProNET Token Ring
DLT_PRONET :: Link

-- | Chaos
DLT_CHAOS :: Link

-- | IEEE 802 networks
DLT_IEEE802 :: Link

-- | ARCNET
DLT_ARCNET :: Link

-- | Serial line IP
DLT_SLIP :: Link

-- | Point-to-point protocol
DLT_PPP :: Link

-- | FDDI
DLT_FDDI :: Link

-- | LLC SNAP encapsulated ATM
DLT_ATM_RFC1483 :: Link

-- | raw IP
DLT_RAW :: Link

-- | BSD OS serial line IP
DLT_SLIP_BSDOS :: Link

-- | BSD OS point-to-point protocol
DLT_PPP_BSDOS :: Link

-- | Linux classical IP over ATM
DLT_ATM_CLIP :: Link

-- | Redback SmartEdge 400/800
DLT_REDBACK_SMARTEDGE :: Link

-- | PPP over serial with HDLC encapsulation
DLT_PPP_SERIAL :: Link

-- | PPP over ethernet
DLT_PPP_ETHER :: Link

-- | Symantec Enterprise Firewall
DLT_SYMANTEC_FIREWALL :: Link

-- | Cisco HDLC
DLT_C_HDLC :: Link

-- | IEEE 802.11 wireless
DLT_IEEE802_11 :: Link

-- | Frame Relay
DLT_FRELAY :: Link

-- | OpenBSD loopback device
DLT_LOOP :: Link

-- | Encapsulated packets for IPsec
DLT_ENC :: Link

-- | Linux cooked sockets
DLT_LINUX_SLL :: Link

-- | Apple LocalTalk
DLT_LTALK :: Link

-- | Acorn Econet
DLT_ECONET :: Link

-- | OpenBSD's old ipfilter
DLT_IPFILTER :: Link

-- | OpenBSD's pflog
DLT_PFLOG :: Link

-- | Cisco IOS
DLT_CISCO_IOS :: Link

-- | Intersil Prism II wireless chips
DLT_PRISM_HEADER :: Link

-- | Aironet (Cisco) 802.11 wireless
DLT_AIRONET_HEADER :: Link

-- | Siemens HiPath HDLC
DLT_HHDLC :: Link

-- | RFC 2625 IP-over-Fibre Channel
DLT_IP_OVER_FC :: Link

-- | Full Frontal ATM on Solaris with SunATM
DLT_SUNATM :: Link

-- | <ol>
--   <li>11 plus a number of bits of link-layer information</li>
--   </ol>
DLT_IEEE802_11_RADIO :: Link

-- | Linux ARCNET header
DLT_ARCNET_LINUX :: Link

-- | Apple IP-over-IEEE 1394
DLT_APPLE_IP_OVER_IEEE1394 :: Link

-- | SS7, C7 MTP2 with pseudo-header
DLT_MTP2_WITH_PHDR :: Link

-- | SS7, C7 Message Transfer Part 2 (MPT2)
DLT_MTP2 :: Link

-- | SS7, C7 Message Transfer Part 3 (MPT3)
DLT_MTP3 :: Link

-- | SS7, C7 SCCP
DLT_SCCP :: Link

-- | DOCSIS MAC frame
DLT_DOCSIS :: Link

-- | Linux IrDA packet
DLT_LINUX_IRDA :: Link

-- | Reserved for private use
DLT_USER0 :: Link

-- | Reserved for private use
DLT_USER1 :: Link

-- | Reserved for private use
DLT_USER2 :: Link

-- | Reserved for private use
DLT_USER3 :: Link

-- | Reserved for private use
DLT_USER4 :: Link

-- | Reserved for private use
DLT_USER5 :: Link

-- | Reserved for private use
DLT_USER6 :: Link

-- | Reserved for private use
DLT_USER7 :: Link

-- | Reserved for private use
DLT_USER8 :: Link

-- | Reserved for private use
DLT_USER9 :: Link

-- | Reserved for private use
DLT_USER10 :: Link

-- | Reserved for private use
DLT_USER11 :: Link

-- | Reserved for private use
DLT_USER12 :: Link

-- | Reserved for private use
DLT_USER13 :: Link

-- | Reserved for private use
DLT_USER14 :: Link

-- | Reserved for private use
DLT_USER15 :: Link

-- | Outgoing packets for ppp daemon
DLT_PPP_PPPD :: Link

-- | GPRS LLC
DLT_GPRS_LLC :: Link

-- | GPF-T (ITU-T G.7041/Y.1303)
DLT_GPF_T :: Link

-- | GPF-F (ITU-T G.7041/Y.1303)
DLT_GPF_F :: Link

-- | Raw LAPD for vISDN (<i>not</i> generic LAPD)
DLT_LINUX_LAPD :: Link

-- | ARINC 429
DLT_A429 :: Link

-- | ARINC 653 Interpartition Communication messages
DLT_A653_ICM :: Link

-- | USB packet
DLT_USB :: Link

-- | Bluetooth HCI UART transport layer (part H:4)
DLT_BLUETOOTH_HCI_H4 :: Link

-- | Multi Link Frame Relay (FRF.16)
DLT_MFR :: Link

-- | IEEE 802.16 MAC Common Part Sublayer
DLT_IEEE802_16_MAC_CPS :: Link

-- | USB packets, beginning with a Linux USB header
DLT_USB_LINUX :: Link

-- | Controller Area Network (CAN) v2.0B
DLT_CAN20B :: Link

-- | IEEE 802.15.4, with address fields padded
DLT_IEEE802_15_4_LINUX :: Link

-- | Per Packet Information encapsulated packets
DLT_PPI :: Link

-- | <ol>
--   <li>16 MAC Common Part Sublayer with radiotap radio header</li>
--   </ol>
DLT_IEEE802_16_MAC_CPS_RADIO :: Link

-- | IEEE 802.15.4, exactly as in the spec
DLT_IEEE802_15_4 :: Link
DLT_PFSYNC :: Link

-- | The interface structure.
data Interface
Interface :: String -> String -> [PcapAddr] -> Word32 -> Interface

-- | the interface name
[ifName] :: Interface -> String

-- | interface description string (if any)
[ifDescription] :: Interface -> String

-- | address families supported by this interface
[ifAddresses] :: Interface -> [PcapAddr]
[ifFlags] :: Interface -> Word32

-- | The address structure.
data PcapAddr
PcapAddr :: SockAddr -> Maybe SockAddr -> Maybe SockAddr -> Maybe SockAddr -> PcapAddr

-- | interface address
[addrSA] :: PcapAddr -> SockAddr

-- | network mask
[addrMask] :: PcapAddr -> Maybe SockAddr

-- | broadcast address
[addrBcast] :: PcapAddr -> Maybe SockAddr

-- | address of peer, of a point-to-point link
[addrPeer] :: PcapAddr -> Maybe SockAddr

-- | The socket address record. Note that this is not the same as SockAddr
--   from <a>Socket</a>. (That is a Haskell version of C's <tt>struct
--   sockaddr_in</tt>. This is the real <tt>struct sockaddr</tt> from the
--   BSD network stack.)
data SockAddr
SockAddr :: !Family -> {-# UNPACK #-} !ByteString -> SockAddr

-- | an address family exported by Network.Socket
[saFamily] :: SockAddr -> !Family
[saAddr] :: SockAddr -> {-# UNPACK #-} !ByteString

-- | The network address record. Both the address and mask are in network
--   byte order.
data Network
Network :: {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> Network

-- | IPv4 network address
[netAddr] :: Network -> {-# UNPACK #-} !Word32

-- | IPv4 netmask
[netMask] :: Network -> {-# UNPACK #-} !Word32
data PktHdr
PktHdr :: {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> PktHdr

-- | timestamp (seconds)
[hdrSeconds] :: PktHdr -> {-# UNPACK #-} !Word32

-- | timestamp (microseconds)
[hdrUseconds] :: PktHdr -> {-# UNPACK #-} !Word32

-- | number of bytes present in capture
[hdrCaptureLength] :: PktHdr -> {-# UNPACK #-} !Word32

-- | number of bytes on the wire
[hdrWireLength] :: PktHdr -> {-# UNPACK #-} !Word32
data Statistics
Statistics :: {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> Statistics

-- | packets received
[statReceived] :: Statistics -> {-# UNPACK #-} !Word32

-- | packets dropped by <tt>libpcap</tt>
[statDropped] :: Statistics -> {-# UNPACK #-} !Word32

-- | packets dropped by the network interface
[statIfaceDropped] :: Statistics -> {-# UNPACK #-} !Word32

-- | <a>openOffline</a> opens a dump file for reading. The file format is
--   the same as used by <tt>tcpdump</tt> and Wireshark. The string
--   <tt>"-"</tt> is a synonym for <tt>stdin</tt>.
openOffline :: FilePath -> IO (ForeignPtr PcapTag)

-- | <a>openLive</a> is used to get a packet descriptor that can be used to
--   look at packets on the network. The arguments are the device name, the
--   snapshot length (in bytes), the promiscuity of the interface
--   (<a>True</a> == promiscuous) and a timeout in milliseconds.
--   
--   Using <tt>"any"</tt> as the device name will capture packets from all
--   interfaces. On some systems, reading from the <tt>"any"</tt> device is
--   incompatible with setting the interfaces into promiscuous mode. In
--   that case, only packets whose link layer addresses match those of the
--   interfaces are captured.
openLive :: String -> Int -> Bool -> Int -> IO (ForeignPtr PcapTag)

-- | <a>openDead</a> is used to get a packet capture descriptor without
--   opening a file or device. It is typically used to test packet filter
--   compilation by <a>setFilter</a>. The arguments are the link type and
--   the snapshot length.
openDead :: Link -> Int -> IO (ForeignPtr PcapTag)

-- | <a>openDump</a> opens a dump file for writing. This dump file is
--   written to by the <a>dump</a> function. The arguments are a raw packet
--   capture descriptor and the file name, with "-" as a synonym for
--   <tt>stdout</tt>.
openDump :: Ptr PcapTag -> FilePath -> IO Pdump

-- | Set a filter on the specified packet capture descriptor. Valid filter
--   strings are those accepted by <tt>tcpdump</tt>.
setFilter :: Ptr PcapTag -> String -> Bool -> Word32 -> IO ()

-- | Compile a filter for use by another program using the Berkeley Packet
--   Filter library.
compileFilter :: Int -> Link -> String -> Bool -> Word32 -> IO BpfProgram

-- | <a>lookupDev</a> returns the name of a device suitable for use with
--   <a>openLive</a> and <a>lookupNet</a>. If you only have one interface,
--   it is the function of choice. If not, see <a>findAllDevs</a>.
lookupDev :: IO String

-- | <a>findAllDevs</a> returns a list of all the network devices that can
--   be opened by <a>openLive</a>. It returns only those devices that the
--   calling process has sufficient privileges to open, so it may not find
--   every device on the system.
findAllDevs :: IO [Interface]

-- | Return the network address and mask for the specified interface name.
--   Only valid for IPv4. For other protocols, use <a>findAllDevs</a> and
--   search the <a>Interface</a> list for the associated network mask.
lookupNet :: String -> IO Network

-- | Set a packet capture descriptor into non-blocking mode if the second
--   argument is <a>True</a>, otherwise put it in blocking mode. Note that
--   the packet capture descriptor must have been obtained from
--   <a>openLive</a>.
setNonBlock :: Ptr PcapTag -> Bool -> IO ()

-- | Return the blocking status of the packet capture descriptor.
--   <a>True</a> indicates that the descriptor is non-blocking. Descriptors
--   referring to dump files opened by <a>openDump</a> always return
--   <a>False</a>.
getNonBlock :: Ptr PcapTag -> IO Bool

-- | Specify the direction in which packets are to be captured. Complete
--   functionality is not necessarily available on all platforms.
setDirection :: Ptr PcapTag -> Direction -> IO ()

-- | Returns the datalink type associated with the given pcap descriptor.
datalink :: Ptr PcapTag -> IO Link

-- | Sets the datalink type for a given pcap descriptor.
setDatalink :: Ptr PcapTag -> Link -> IO ()

-- | List all the datalink types supported by a pcap descriptor. Entries
--   from the resulting list are valid arguments to <a>setDatalink</a>.
listDatalinks :: Ptr PcapTag -> IO [Link]

-- | Collect and process packets. The arguments are the packet capture
--   descriptor, the count and a callback function.
--   
--   The count is the maximum number of packets to process before
--   returning. A count of -1 means process all of the packets received in
--   one buffer (if a live capture) or all of the packets in a dump file
--   (if offline).
--   
--   The callback function is passed two arguments, a packet header record
--   and a pointer to the packet data (<tt>Ptr Word8</tt>). The header
--   record contains the number of bytes captured, which can be used to
--   marshal the data into a list or array.
dispatch :: Ptr PcapTag -> Int -> Callback -> IO Int

-- | Similar to <a>dispatch</a>, but loop until the number of packets
--   specified by the second argument are read. A negative value loops
--   forever.
--   
--   This function does not return when a live read timeout occurs. Use
--   <a>dispatch</a> instead if you want to specify a timeout.
loop :: Ptr PcapTag -> Int -> Callback -> IO Int

-- | Read the next packet (equivalent to calling <a>dispatch</a> with a
--   count of 1).
next :: Ptr PcapTag -> IO (PktHdr, Ptr Word8)

-- | Write the packet data given by the second and third arguments to a
--   dump file opened by <a>openDead</a>. <a>dump</a> is designed so it can
--   be easily used as a default callback function by <a>dispatch</a> or
--   <a>loop</a>.
dump :: Ptr PcapDumpTag -> Ptr PktHdr -> Ptr Word8 -> IO ()

-- | Send a raw packet through the network interface.
sendPacket :: Ptr PcapTag -> Ptr Word8 -> Int -> IO ()
toPktHdr :: Ptr PktHdr -> IO PktHdr

-- | Returns the number of packets received, the number of packets dropped
--   by the packet filter and the number of packets dropped by the
--   interface (before processing by the packet filter).
statistics :: Ptr PcapTag -> IO Statistics

-- | Version of the library. The returned pair consists of the major and
--   minor version numbers.
version :: Ptr PcapTag -> IO (Int, Int)

-- | <a>isSwapped</a> returns <a>True</a> if the current dump file uses a
--   different byte order than the one native to the system.
isSwapped :: Ptr PcapTag -> IO Bool

-- | The snapshot length that was used in the call to <a>openLive</a>.
snapshotLen :: Ptr PcapTag -> IO Int
instance GHC.Show.Show Network.Pcap.Base.PktHdr
instance GHC.Classes.Eq Network.Pcap.Base.PktHdr
instance GHC.Show.Show Network.Pcap.Base.Statistics
instance GHC.Classes.Eq Network.Pcap.Base.Statistics
instance GHC.Show.Show Network.Pcap.Base.SockAddr
instance GHC.Read.Read Network.Pcap.Base.SockAddr
instance GHC.Classes.Eq Network.Pcap.Base.SockAddr
instance GHC.Show.Show Network.Pcap.Base.PcapAddr
instance GHC.Read.Read Network.Pcap.Base.PcapAddr
instance GHC.Classes.Eq Network.Pcap.Base.PcapAddr
instance GHC.Show.Show Network.Pcap.Base.Interface
instance GHC.Read.Read Network.Pcap.Base.Interface
instance GHC.Classes.Eq Network.Pcap.Base.Interface
instance GHC.Show.Show Network.Pcap.Base.Network
instance GHC.Read.Read Network.Pcap.Base.Network
instance GHC.Classes.Eq Network.Pcap.Base.Network
instance GHC.Read.Read Network.Pcap.Base.Direction
instance GHC.Show.Show Network.Pcap.Base.Direction
instance GHC.Classes.Eq Network.Pcap.Base.Direction
instance GHC.Show.Show Network.Pcap.Base.Link
instance GHC.Read.Read Network.Pcap.Base.Link
instance GHC.Classes.Ord Network.Pcap.Base.Link
instance GHC.Classes.Eq Network.Pcap.Base.Link


-- | The <a>Pcap</a> module is a high(ish) level binding to all of the
--   functions in <tt>libpcap</tt>. See <a>http://www.tcpdump.org</a> for
--   more information.
--   
--   This module is built on the lower-level <a>Base</a> module, which is
--   slightly more efficient. Don't use <a>Base</a> unless profiling data
--   indicates that you need to.
--   
--   Only a minimum of marshaling is done on received packets. To convert
--   captured packet data to a <a>ByteString</a> (space efficient, and with
--   <i>O(1)</i> access to every byte in a captured packet), use
--   <a>toBS</a>.
--   
--   Note that the <a>SockAddr</a> exported here is not the
--   <tt>SockAddr</tt> from <a>Socket</a>. The <tt>SockAddr</tt> from
--   <a>Socket</a> corresponds to <tt>struct sockaddr_in</tt> in BSD
--   terminology. The <a>SockAddr</a> record here is BSD's <tt>struct
--   sockaddr</tt>. See W.R.Stevens, TCP Illustrated, volume 2, for further
--   elucidation.
--   
--   This binding should be portable across systems that can use the
--   <tt>libpcap</tt> from <tt>tcpdump.org</tt>. It does not yet work with
--   Winpcap, a similar library for Windows, although adapting it should
--   not prove difficult.
module Network.Pcap

-- | Packet capture handle.
data PcapHandle

-- | Dump file handle.
data DumpHandle

-- | Compiled Berkeley Packet Filter program.
type BpfProgram = ForeignPtr BpfProgramTag

-- | the type of the callback function passed to <a>dispatch</a> or
--   <a>loop</a>.
type Callback = PktHdr -> Ptr Word8 -> IO ()

-- | Callback using <a>ByteString</a> for packet body.
type CallbackBS = PktHdr -> ByteString -> IO ()

-- | The direction in which packets are to be captured. See
--   <a>setDirection</a>.
data Direction

-- | incoming and outgoing packets (the default)
InOut :: Direction

-- | incoming packets
In :: Direction

-- | outgoing packets
Out :: Direction

-- | Datalink types.
--   
--   This covers all of the datalink types defined in bpf.h. Types defined
--   on your system may vary.
data Link

-- | no link layer encapsulation
DLT_NULL :: Link

-- | unknown encapsulation
DLT_UNKNOWN :: Int -> Link

-- | 10 Mbit per second (or faster) ethernet
DLT_EN10MB :: Link

-- | original 3 Mbit per second ethernet
DLT_EN3MB :: Link

-- | amateur radio AX.25
DLT_AX25 :: Link

-- | Proteon ProNET Token Ring
DLT_PRONET :: Link

-- | Chaos
DLT_CHAOS :: Link

-- | IEEE 802 networks
DLT_IEEE802 :: Link

-- | ARCNET
DLT_ARCNET :: Link

-- | Serial line IP
DLT_SLIP :: Link

-- | Point-to-point protocol
DLT_PPP :: Link

-- | FDDI
DLT_FDDI :: Link

-- | LLC SNAP encapsulated ATM
DLT_ATM_RFC1483 :: Link

-- | raw IP
DLT_RAW :: Link

-- | BSD OS serial line IP
DLT_SLIP_BSDOS :: Link

-- | BSD OS point-to-point protocol
DLT_PPP_BSDOS :: Link

-- | Linux classical IP over ATM
DLT_ATM_CLIP :: Link

-- | Redback SmartEdge 400/800
DLT_REDBACK_SMARTEDGE :: Link

-- | PPP over serial with HDLC encapsulation
DLT_PPP_SERIAL :: Link

-- | PPP over ethernet
DLT_PPP_ETHER :: Link

-- | Symantec Enterprise Firewall
DLT_SYMANTEC_FIREWALL :: Link

-- | Cisco HDLC
DLT_C_HDLC :: Link

-- | IEEE 802.11 wireless
DLT_IEEE802_11 :: Link

-- | Frame Relay
DLT_FRELAY :: Link

-- | OpenBSD loopback device
DLT_LOOP :: Link

-- | Encapsulated packets for IPsec
DLT_ENC :: Link

-- | Linux cooked sockets
DLT_LINUX_SLL :: Link

-- | Apple LocalTalk
DLT_LTALK :: Link

-- | Acorn Econet
DLT_ECONET :: Link

-- | OpenBSD's old ipfilter
DLT_IPFILTER :: Link

-- | OpenBSD's pflog
DLT_PFLOG :: Link

-- | Cisco IOS
DLT_CISCO_IOS :: Link

-- | Intersil Prism II wireless chips
DLT_PRISM_HEADER :: Link

-- | Aironet (Cisco) 802.11 wireless
DLT_AIRONET_HEADER :: Link

-- | Siemens HiPath HDLC
DLT_HHDLC :: Link

-- | RFC 2625 IP-over-Fibre Channel
DLT_IP_OVER_FC :: Link

-- | Full Frontal ATM on Solaris with SunATM
DLT_SUNATM :: Link

-- | <ol>
--   <li>11 plus a number of bits of link-layer information</li>
--   </ol>
DLT_IEEE802_11_RADIO :: Link

-- | Linux ARCNET header
DLT_ARCNET_LINUX :: Link

-- | Apple IP-over-IEEE 1394
DLT_APPLE_IP_OVER_IEEE1394 :: Link

-- | SS7, C7 MTP2 with pseudo-header
DLT_MTP2_WITH_PHDR :: Link

-- | SS7, C7 Message Transfer Part 2 (MPT2)
DLT_MTP2 :: Link

-- | SS7, C7 Message Transfer Part 3 (MPT3)
DLT_MTP3 :: Link

-- | SS7, C7 SCCP
DLT_SCCP :: Link

-- | DOCSIS MAC frame
DLT_DOCSIS :: Link

-- | Linux IrDA packet
DLT_LINUX_IRDA :: Link

-- | Reserved for private use
DLT_USER0 :: Link

-- | Reserved for private use
DLT_USER1 :: Link

-- | Reserved for private use
DLT_USER2 :: Link

-- | Reserved for private use
DLT_USER3 :: Link

-- | Reserved for private use
DLT_USER4 :: Link

-- | Reserved for private use
DLT_USER5 :: Link

-- | Reserved for private use
DLT_USER6 :: Link

-- | Reserved for private use
DLT_USER7 :: Link

-- | Reserved for private use
DLT_USER8 :: Link

-- | Reserved for private use
DLT_USER9 :: Link

-- | Reserved for private use
DLT_USER10 :: Link

-- | Reserved for private use
DLT_USER11 :: Link

-- | Reserved for private use
DLT_USER12 :: Link

-- | Reserved for private use
DLT_USER13 :: Link

-- | Reserved for private use
DLT_USER14 :: Link

-- | Reserved for private use
DLT_USER15 :: Link

-- | Outgoing packets for ppp daemon
DLT_PPP_PPPD :: Link

-- | GPRS LLC
DLT_GPRS_LLC :: Link

-- | GPF-T (ITU-T G.7041/Y.1303)
DLT_GPF_T :: Link

-- | GPF-F (ITU-T G.7041/Y.1303)
DLT_GPF_F :: Link

-- | Raw LAPD for vISDN (<i>not</i> generic LAPD)
DLT_LINUX_LAPD :: Link

-- | ARINC 429
DLT_A429 :: Link

-- | ARINC 653 Interpartition Communication messages
DLT_A653_ICM :: Link

-- | USB packet
DLT_USB :: Link

-- | Bluetooth HCI UART transport layer (part H:4)
DLT_BLUETOOTH_HCI_H4 :: Link

-- | Multi Link Frame Relay (FRF.16)
DLT_MFR :: Link

-- | IEEE 802.16 MAC Common Part Sublayer
DLT_IEEE802_16_MAC_CPS :: Link

-- | USB packets, beginning with a Linux USB header
DLT_USB_LINUX :: Link

-- | Controller Area Network (CAN) v2.0B
DLT_CAN20B :: Link

-- | IEEE 802.15.4, with address fields padded
DLT_IEEE802_15_4_LINUX :: Link

-- | Per Packet Information encapsulated packets
DLT_PPI :: Link

-- | <ol>
--   <li>16 MAC Common Part Sublayer with radiotap radio header</li>
--   </ol>
DLT_IEEE802_16_MAC_CPS_RADIO :: Link

-- | IEEE 802.15.4, exactly as in the spec
DLT_IEEE802_15_4 :: Link
DLT_PFSYNC :: Link

-- | The interface structure.
data Interface
Interface :: String -> String -> [PcapAddr] -> Word32 -> Interface

-- | the interface name
[ifName] :: Interface -> String

-- | interface description string (if any)
[ifDescription] :: Interface -> String

-- | address families supported by this interface
[ifAddresses] :: Interface -> [PcapAddr]
[ifFlags] :: Interface -> Word32

-- | The address structure.
data PcapAddr
PcapAddr :: SockAddr -> Maybe SockAddr -> Maybe SockAddr -> Maybe SockAddr -> PcapAddr

-- | interface address
[addrSA] :: PcapAddr -> SockAddr

-- | network mask
[addrMask] :: PcapAddr -> Maybe SockAddr

-- | broadcast address
[addrBcast] :: PcapAddr -> Maybe SockAddr

-- | address of peer, of a point-to-point link
[addrPeer] :: PcapAddr -> Maybe SockAddr

-- | The socket address record. Note that this is not the same as SockAddr
--   from <a>Socket</a>. (That is a Haskell version of C's <tt>struct
--   sockaddr_in</tt>. This is the real <tt>struct sockaddr</tt> from the
--   BSD network stack.)
data SockAddr
SockAddr :: !Family -> {-# UNPACK #-} !ByteString -> SockAddr

-- | an address family exported by Network.Socket
[saFamily] :: SockAddr -> !Family
[saAddr] :: SockAddr -> {-# UNPACK #-} !ByteString

-- | The network address record. Both the address and mask are in network
--   byte order.
data Network
Network :: {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> Network

-- | IPv4 network address
[netAddr] :: Network -> {-# UNPACK #-} !Word32

-- | IPv4 netmask
[netMask] :: Network -> {-# UNPACK #-} !Word32
data PktHdr
PktHdr :: {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> PktHdr

-- | timestamp (seconds)
[hdrSeconds] :: PktHdr -> {-# UNPACK #-} !Word32

-- | timestamp (microseconds)
[hdrUseconds] :: PktHdr -> {-# UNPACK #-} !Word32

-- | number of bytes present in capture
[hdrCaptureLength] :: PktHdr -> {-# UNPACK #-} !Word32

-- | number of bytes on the wire
[hdrWireLength] :: PktHdr -> {-# UNPACK #-} !Word32
data Statistics
Statistics :: {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> {-# UNPACK #-} !Word32 -> Statistics

-- | packets received
[statReceived] :: Statistics -> {-# UNPACK #-} !Word32

-- | packets dropped by <tt>libpcap</tt>
[statDropped] :: Statistics -> {-# UNPACK #-} !Word32

-- | packets dropped by the network interface
[statIfaceDropped] :: Statistics -> {-# UNPACK #-} !Word32

-- | <a>openOffline</a> opens a dump file for reading. The file format is
--   the same as used by <tt>tcpdump</tt> and Wireshark. The string
--   <tt>"-"</tt> is a synonym for <tt>stdin</tt>.
openOffline :: FilePath -> IO PcapHandle

-- | <a>openLive</a> is used to get a <a>PcapHandle</a> that can be used to
--   look at packets on the network. The arguments are the device name, the
--   snapshot length (in bytes), the promiscuity of the interface
--   (<a>True</a> == promiscuous) and a timeout in microseconds.
--   
--   The timeout allows the packet filter to delay while accumulating
--   multiple packets, which is more efficient than reading packets one by
--   one. A timeout of zero will wait indefinitely for "enough" packets to
--   arrive.
--   
--   Using <tt>"any"</tt> as the device name will capture packets from all
--   interfaces. On some systems, reading from the <tt>"any"</tt> device is
--   incompatible with setting the interfaces into promiscuous mode. In
--   that case, only packets whose link layer addresses match those of the
--   interfaces are captured.
openLive :: String -> Int -> Bool -> Int64 -> IO PcapHandle

-- | <a>openDead</a> is used to get a <a>PcapHandle</a> without opening a
--   file or device. It is typically used to test packet filter compilation
--   by <a>setFilter</a>. The arguments are the link type and the snapshot
--   length.
openDead :: Link -> Int -> IO PcapHandle

-- | <a>openDump</a> opens a dump file for writing. This dump file is
--   written to by the <a>dump</a> function.
openDump :: PcapHandle -> FilePath -> IO DumpHandle

-- | Set a filter on the specified packet capture handle. Valid filter
--   strings are those accepted by <tt>tcpdump</tt>.
setFilter :: PcapHandle -> String -> Bool -> Word32 -> IO ()

-- | Compile a filter for use by another program using the Berkeley Packet
--   Filter library.
compileFilter :: Int -> Link -> String -> Bool -> Word32 -> IO BpfProgram

-- | <a>lookupDev</a> returns the name of a device suitable for use with
--   <a>openLive</a> and <a>lookupNet</a>. If you only have one interface,
--   it is the function of choice. If not, see <a>findAllDevs</a>.
lookupDev :: IO String

-- | <a>findAllDevs</a> returns a list of all the network devices that can
--   be opened by <a>openLive</a>. It returns only those devices that the
--   calling process has sufficient privileges to open, so it may not find
--   every device on the system.
findAllDevs :: IO [Interface]

-- | Return the network address and mask for the specified interface name.
--   Only valid for IPv4. For other protocols, use <a>findAllDevs</a> and
--   search the <a>Interface</a> list for the associated network mask.
lookupNet :: String -> IO Network

-- | Set the given <a>PcapHandle</a> into non-blocking mode if the second
--   argument is <a>True</a>, otherwise put it in blocking mode. Note that
--   the <a>PcapHandle</a> must have been obtained from <a>openLive</a>.
setNonBlock :: PcapHandle -> Bool -> IO ()

-- | Return the blocking status of the <a>PcapHandle</a>. <a>True</a>
--   indicates that the handle is non-blocking. Handles referring to dump
--   files opened by <a>openDump</a> always return <a>False</a>.
getNonBlock :: PcapHandle -> IO Bool

-- | Specify the direction in which packets are to be captured. Complete
--   functionality is not necessarily available on all platforms.
setDirection :: PcapHandle -> Direction -> IO ()

-- | Returns the datalink type associated with the given handle.
datalink :: PcapHandle -> IO Link

-- | Sets the datalink type for the given handle.
setDatalink :: PcapHandle -> Link -> IO ()

-- | List all the datalink types supported by the given handle. Entries
--   from the resulting list are valid arguments to <a>setDatalink</a>.
listDatalinks :: PcapHandle -> IO [Link]

-- | Collect and process packets.
--   
--   The count is the maximum number of packets to process before
--   returning. A count of -1 means process all of the packets received in
--   one buffer (if a live capture) or all of the packets in a dump file
--   (if offline).
--   
--   The callback function is passed two arguments, a packet header record
--   and a pointer to the packet data (<tt>Ptr Word8</tt>). THe header
--   record contains the number of bytes captured, which can be used to
--   marshal the data into a list, array, or <a>ByteString</a> (using
--   <a>toBS</a>).
dispatch :: PcapHandle -> Int -> Callback -> IO Int

-- | Similar to <a>dispatch</a>, but loop until the number of packets
--   specified by the second argument are read. A negative value loops
--   forever.
--   
--   This function does not return when a live read timeout occurs. Use
--   <a>dispatch</a> instead if you want to specify a timeout.
loop :: PcapHandle -> Int -> Callback -> IO Int

-- | Read the next packet (equivalent to calling <a>dispatch</a> with a
--   count of 1).
next :: PcapHandle -> IO (PktHdr, Ptr Word8)

-- | Write the packet data given by the second and third arguments to a
--   dump file opened by <a>openDead</a>. <a>dump</a> is designed so it can
--   be easily used as a default callback function by <a>dispatch</a> or
--   <a>loop</a>.
dump :: DumpHandle -> Ptr PktHdr -> Ptr Word8 -> IO ()

-- | Variant of <a>dispatch</a> for use with <a>ByteString</a>.
dispatchBS :: PcapHandle -> Int -> CallbackBS -> IO Int

-- | Variant of <a>loop</a> for use with <a>ByteString</a>.
loopBS :: PcapHandle -> Int -> CallbackBS -> IO Int
nextBS :: PcapHandle -> IO (PktHdr, ByteString)
dumpBS :: DumpHandle -> Ptr PktHdr -> ByteString -> IO ()

-- | Send a raw packet through the network interface.
sendPacket :: PcapHandle -> Ptr Word8 -> Int -> IO ()

-- | Variant of <a>sendPacket</a> for use with <a>ByteString</a>.
sendPacketBS :: PcapHandle -> ByteString -> IO ()

-- | Represent a captured packet as a <a>ByteString</a>. Suitable for use
--   as is with the result of <a>next</a>, or use <tt><a>curry</a>
--   <a>toBS</a></tt> inside a <a>Callback</a> with <a>dispatch</a>.
toBS :: (PktHdr, Ptr Word8) -> IO (PktHdr, ByteString)

-- | Get the timestamp of a packet as a single quantity, in microseconds.
hdrTime :: PktHdr -> Int64

-- | Get the timestamp of a packet as a <a>DiffTime</a>.
hdrDiffTime :: PktHdr -> DiffTime

-- | Returns the number of packets received, the number of packets dropped
--   by the packet filter and the number of packets dropped by the
--   interface (before processing by the packet filter).
statistics :: PcapHandle -> IO Statistics

-- | Version of the library. The returned pair consists of the major and
--   minor version numbers.
version :: PcapHandle -> IO (Int, Int)

-- | <a>isSwapped</a> returns <a>True</a> if the current dump file uses a
--   different byte order than the one native to the system.
isSwapped :: PcapHandle -> IO Bool

-- | The snapshot length that was used in the call to <a>openLive</a>.
snapshotLen :: PcapHandle -> IO Int
