src/org/jnetpcap/winpcap/WinPcap.java
public native static WinPcap openLive(String device,
			int snaplen,
			int promisc,
			int timeout,
			StringBuffer errbuf);
/**
	 * <p>
	 * This method, overrides the generic libpcap based <code>openLive</code>
	 * method, and allocates a peer pcap object that allows WinPcap extensions.
	 * </p>
	 * <p>
	 * Open a live capture associated with the specified network interface device.
	 * pcap_open_live() is used to obtain a packet capture descriptor to look at
	 * packets on the network. device is a string that specifies the network
	 * device to open; on Linux systems with 2.2 or later kernels, a device
	 * argument of "any" or NULL can be used to capture packets from all
	 * interfaces. snaplen specifies the maximum number of bytes to capture. If
	 * this value is less than the size of a packet that is captured, only the
	 * first snaplen bytes of that packet will be captured and provided as packet
	 * data. A value of 65535 should be sufficient, on most if not all networks,
	 * to capture all the data available from the packet. promisc specifies if the
	 * interface is to be put into promiscuous mode. (Note that even if this
	 * parameter is false, the interface could well be in promiscuous mode for
	 * some other reason.)
	 * </p>
	 * <p>
	 * For now, this doesn't work on the "any" device; if an argument of "any" or
	 * NULL is supplied, the promisc flag is ignored. to_ms specifies the read
	 * timeout in milliseconds. The read timeout is used to arrange that the read
	 * not necessarily return immediately when a packet is seen, but that it wait
	 * for some amount of time to allow more packets to arrive and to read
	 * multiple packets from the OS kernel in one operation. Not all platforms
	 * support a read timeout; on platforms that don't, the read timeout is
	 * ignored. A zero value for to_ms, on platforms that support a read timeout,
	 * will cause a read to wait forever to allow enough packets to arrive, with
	 * no timeout. errbuf is used to return error or warning text. It will be set
	 * to error text when pcap_open_live() fails and returns NULL. errbuf may also
	 * be set to warning text when pcap_open_live() succeds; to detect this case
	 * the caller should store a zero-length string in errbuf before calling
	 * pcap_open_live() and display the warning to the user if errbuf is no longer
	 * a zero-length string.
	 * </p>
	 * <p>
	 * <b>Special note about <code>snaplen</code> argument.</b> The behaviour of
	 * this argument may be suprizing to some. The <code>argument</code> is only
	 * applied when there is a filter set using <code>setFilter</code> method
	 * after the <code>openLive</code> call. Otherwise snaplen, even non zero is
	 * ignored. This is the behavior of all BSD systems utilizing BPF and WinPcap.
	 * This may change in the future, but that is the current behavior. (For more
	 * detailed explanation and discussion please see jNetPcap website and its
	 * FAQs.)
	 * </p>
	 * 
	 * @param device
	 *          buffer containing a C, '\0' terminated string with the the name of
	 *          the device
	 * @param snaplen
	 *          amount of data to capture per packet; (see special note in doc
	 *          comments about when this argument is ignored even when non-zero)
	 * @param promisc
	 *          1 means open in promiscious mode, a 0 means non-propmiscous
	 * @param timeout
	 *          timeout in ms
	 * @param errbuf
	 *          a buffer that will contain any error messages if the call to open
	 *          failed
	 * @return a raw structure the data of <code>pcap_t</code> C structure as
	 *         returned by native libpcap call to open
	 * @see Pcap#openLive(String, int, int, int, StringBuilder)
	 * @since 1.2
	 */

This method, overrides the generic libpcap based openLive
method, and allocates a peer pcap object that allows WinPcap extensions.


Open a live capture associated with the specified network interface device.
pcap_open_live() is used to obtain a packet capture descriptor to look at
packets on the network. device is a string that specifies the network
device to open; on Linux systems with 2.2 or later kernels, a device
argument of "any" or NULL can be used to capture packets from all
interfaces. snaplen specifies the maximum number of bytes to capture. If
this value is less than the size of a packet that is captured, only the
first snaplen bytes of that packet will be captured and provided as packet
data. A value of 65535 should be sufficient, on most if not all networks,
to capture all the data available from the packet. promisc specifies if the
interface is to be put into promiscuous mode. (Note that even if this
parameter is false, the interface could well be in promiscuous mode for
some other reason.)


For now, this doesn't work on the "any" device; if an argument of "any" or
NULL is supplied, the promisc flag is ignored. to_ms specifies the read
timeout in milliseconds. The read timeout is used to arrange that the read
not necessarily return immediately when a packet is seen, but that it wait
for some amount of time to allow more packets to arrive and to read
multiple packets from the OS kernel in one operation. Not all platforms
support a read timeout; on platforms that don't, the read timeout is
ignored. A zero value for to_ms, on platforms that support a read timeout,
will cause a read to wait forever to allow enough packets to arrive, with
no timeout. errbuf is used to return error or warning text. It will be set
to error text when pcap_open_live() fails and returns NULL. errbuf may also
be set to warning text when pcap_open_live() succeds; to detect this case
the caller should store a zero-length string in errbuf before calling
pcap_open_live() and display the warning to the user if errbuf is no longer
a zero-length string.


Special note about snaplen argument. The behaviour of
this argument may be suprizing to some. The argument is only
applied when there is a filter set using setFilter method
after the openLive call. Otherwise snaplen, even non zero is
ignored. This is the behavior of all BSD systems utilizing BPF and WinPcap.
This may change in the future, but that is the current behavior. (For more
detailed explanation and discussion please see jNetPcap website and its
FAQs.)



This method overrides the generic libpcap based openLive method and allocates a peer pcap object that allows WinPcap extensions . Open a live capture associated with the specified network interface device . pcap_open_live () is used to obtain a packet capture descriptor to look at packets on the network . device is a string that specifies the network device to open ; on Linux systems with 2 . 2 or later kernels a device argument of " any " or NULL can be used to capture packets from all interfaces . snaplen specifies the maximum number of bytes to capture . If this value is less than the size of a packet that is captured only the first snaplen bytes of that packet will be captured and provided as packet data . A value of 65535 should be sufficient on most if not all networks to capture all the data available from the packet . promisc specifies if the interface is to be put into promiscuous mode . ( Note that even if this parameter is false the interface could well be in promiscuous mode for some other reason . ) For now this doesn ' t work on the " any " device ; if an argument of " any " or NULL is supplied the promisc flag is ignored . to_ms specifies the read timeout in milliseconds . The read timeout is used to arrange that the read not necessarily return immediately when a packet is seen but that it wait for some amount of time to allow more packets to arrive and to read multiple packets from the OS kernel in one operation . Not all platforms support a read timeout ; on platforms that don ' t the read timeout is ignored . A zero value for to_ms on platforms that support a read timeout will cause a read to wait forever to allow enough packets to arrive with no timeout . errbuf is used to return error or warning text . It will be set to error text when pcap_open_live () fails and returns NULL . errbuf may also be set to warning text when pcap_open_live () succeds ; to detect this case the caller should store a zero - length string in errbuf before calling pcap_open_live () and display the warning to the user if errbuf is no longer a zero - length string . Special note about snaplen argument . The behaviour of this argument may be suprizing to some . The argument is only applied when there is a filter set using setFilter method after the openLive call . Otherwise snaplen even non zero is ignored . This is the behavior of all BSD systems utilizing BPF and WinPcap . This may change in the future but that is the current behavior . ( For more detailed explanation and discussion please see jNetPcap website and its FAQs . )
public native static WinPcap openLive(String device,
			int snaplen,
			int promisc,
			int timeout,
			StringBuffer errbuf);
public native static WinPcap openLive ( String device , int snaplen , int promisc , int timeout , StringBuffer errbuf ) ;
<p>
 This method, overrides the generic libpcap based <code>openLive</code>
 method, and allocates a peer pcap object that allows WinPcap extensions.
<p > This method overrides the generic libpcap based <code > openLive< / code > method and allocates a peer pcap object that allows WinPcap extensions .