Wireshark 2.9.0-477-g68ec514b The Wireshark network protocol analyzer

- Main Page
- Related Pages
- Modules
- Namespaces
- Classes
- Files

Functions
AirPcap functions

## Functions
void | AirpcapGetVersion (guint *VersionMajor, guint *VersionMinor, guint *VersionRev, guint *VersionBuild)
| Return a string with the API version. More...
gchar * | AirpcapGetLastError (PAirpcapHandle AdapterHandle)
| Return the last error related to the specified handle. More...
gboolean | AirpcapGetDeviceList (PAirpcapDeviceDescription *PPAllDevs, gchar *Ebuf)
| Return the list of available devices. More...
void | AirpcapFreeDeviceList (PAirpcapDeviceDescription PAllDevs)
| Free a list of devices returned by AirpcapGetDeviceList() More...
PAirpcapHandle | AirpcapOpen (gchar *DeviceName, gchar *Ebuf)
| Open an adapter. More...
void | AirpcapClose (PAirpcapHandle AdapterHandle)
| Close an adapter. More...
gboolean | AirpcapSetMonitorMode (PAirpcapHandle AdapterHandle, gboolean MonitorModeEnabled)
| Sets the monitor mode for the specified adapter. More...
gboolean | AirpcapGetMonitorMode (PAirpcapHandle AdapterHandle, gboolean *PMonitorModeEnabled)
| Returns TRUE if the specified adapter is in monitor mode. More...
gboolean | AirpcapSetLinkType (PAirpcapHandle AdapterHandle, AirpcapLinkType NewLinkType)
| Set the link type of an adapter. More...
gboolean | AirpcapGetLinkType (PAirpcapHandle AdapterHandle, PAirpcapLinkType PLinkType)
| Get the link type of the specified adapter. More...
gboolean | AirpcapSetFcsPresence (PAirpcapHandle AdapterHandle, gboolean IsFcsPresent)
| Configures the adapter on whether to include the MAC Frame Check Sequence in the captured packets. More...
gboolean | AirpcapGetFcsPresence (PAirpcapHandle AdapterHandle, gboolean *PIsFcsPresent)
| Returns TRUE if the specified adapter includes the MAC Frame Check Sequence in the captured packets. More...
gboolean | AirpcapSetFcsValidation (PAirpcapHandle AdapterHandle, AirpcapValidationType ValidationType)
| Configures the adapter to accept or drop frames with an incorrect Frame Check sequence (FCS). More...
gboolean | AirpcapGetFcsValidation (PAirpcapHandle AdapterHandle, PAirpcapValidationType ValidationType)
| Checks if the specified adapter is configured to capture frames with incorrect an incorrect Frame Check Sequence (FCS). More...
gboolean | AirpcapSetDeviceKeys (PAirpcapHandle AdapterHandle, PAirpcapKeysCollection KeysCollection)
| Set the list of decryption keys that the driver is going to use with the specified device. More...
gboolean | AirpcapGetDeviceKeys (PAirpcapHandle AdapterHandle, PAirpcapKeysCollection KeysCollection, guint *PKeysCollectionSize)
| Returns the list of decryption keys in the driver that are currently associated with the specified device. More...
gboolean | AirpcapSetDriverKeys (PAirpcapHandle AdapterHandle, PAirpcapKeysCollection KeysCollection)
| Set the global list of decryption keys that the driver is going to use with all the devices. More...
gboolean | AirpcapGetDriverKeys (PAirpcapHandle AdapterHandle, PAirpcapKeysCollection KeysCollection, guint *PKeysCollectionSize)
| Returns the global list of decryption keys in the driver that are associated with all the devices. More...
gboolean | AirpcapSetDecryptionState (PAirpcapHandle AdapterHandle, AirpcapDecryptionState Enable)
| Turns on or off the decryption of the incoming frames with the adapter-specific keys. More...
gboolean | AirpcapGetDecryptionState (PAirpcapHandle AdapterHandle, PAirpcapDecryptionState PEnable)
| Tells if this open instance is configured to perform the decryption of the incoming frames with the adapter-specific keys. More...
gboolean | AirpcapSetDriverDecryptionState (PAirpcapHandle AdapterHandle, AirpcapDecryptionState Enable)
| Turns on or off the decryption of the incoming frames with the global driver set of keys. More...
gboolean | AirpcapGetDriverDecryptionState (PAirpcapHandle AdapterHandle, PAirpcapDecryptionState PEnable)
| Tells if this open instance is configured to perform the decryption of the incoming frames with the global driver set of keys. More...
gboolean | AirpcapSetDeviceChannel (PAirpcapHandle AdapterHandle, guint Channel)
| Set the radio channel of a device. More...
gboolean | AirpcapGetDeviceChannel (PAirpcapHandle AdapterHandle, guint *PChannel)
| Get the radio channel of a device. More...
gboolean | AirpcapSetKernelBuffer (PAirpcapHandle AdapterHandle, guint BufferSize)
| Set the size of the kernel packet buffer for this adapter. More...
gboolean | AirpcapGetKernelBufferSize (PAirpcapHandle AdapterHandle, guint *PSizeBytes)
| Get the size of the kernel packet buffer for this adapter. More...
gboolean | AirpcapStoreCurConfigAsAdapterDefault (PAirpcapHandle AdapterHandle)
| Saves the configuration of the specified adapter in the registry, so that it becomes the default for this adapter. More...
gboolean | AirpcapSetFilter (PAirpcapHandle AdapterHandle, void *Instructions, guint Len)
| Set the BPF kernel filter for an adapter. More...
gboolean | AirpcapGetMacAddress (PAirpcapHandle AdapterHandle, PAirpcapMacAddress PMacAddress)
| Return the MAC address of an adapter. More...
gboolean | AirpcapSetMinToCopy (PAirpcapHandle AdapterHandle, guint MinToCopy)
| Set the mintocopy parameter for an open adapter. More...
gboolean | AirpcapGetReadEvent (PAirpcapHandle AdapterHandle, void ***PReadEvent)
| Gets an event that is signaled when that is signalled when packets are available in the kernel buffer (see AirpcapSetMinToCopy()). More...
gboolean | AirpcapRead (PAirpcapHandle AdapterHandle, guint8 *Buffer, guint BufSize, guint *PReceievedBytes)
| Fills a user-provided buffer with zero or more packets that have been captured on the referenced adapter. More...
gboolean | AirpcapWrite (PAirpcapHandle AdapterHandle, gchar *TxPacket, guint32 PacketLen)
| Transmits a packet. More...
gboolean | AirpcapGetStats (PAirpcapHandle AdapterHandle, PAirpcapStats PStats)
| Get per-adapter WinPcap-compatible capture statistics. More...
gboolean | AirpcapGetLedsNumber (PAirpcapHandle AdapterHandle, guint *NumberOfLeds)
| Get the number of LEDs the referenced adapter has available. More...
gboolean | AirpcapTurnLedOn (PAirpcapHandle AdapterHandle, guint LedNumber)
| Turn on one of the adapter's LEDs. More...
gboolean | AirpcapTurnLedOff (PAirpcapHandle AdapterHandle, guint LedNumber)
| Turn off one of the adapter's LEDs. More...
gboolean | AirpcapSetDeviceChannelEx (PAirpcapHandle AdapterHandle, AirpcapChannelInfo ChannelInfo)
| Set the channel of a device through its radio frequency. In case of 802.11n enabled devices, it sets the extension channel, if used. More...
gboolean | AirpcapGetDeviceChannelEx (PAirpcapHandle AdapterHandle, PAirpcapChannelInfo PChannelInfo)
| Get the channel of a device through its radiofrequency. In case of 802.11n enabled devices, it gets the extension channel, if in use. More...
gboolean | AirpcapGetDeviceSupportedChannels (PAirpcapHandle AdapterHandle, PAirpcapChannelInfo *ppChannelInfo, guint *pNumChannelInfo)
| Get the list of supported channels for a given device. In case of a 802.11n capable device, information related to supported extension channels is also reported. More...
gboolean | AirpcapConvertFrequencyToChannel (guint Frequency, guint *PChannel, PAirpcapChannelBand PBand)
| Converts a given frequency to the corresponding channel. More...
gboolean | AirpcapConvertChannelToFrequency (guint Channel, guint *PFrequency)
| Converts a given channel to the corresponding frequency. More...

## Detailed Description

## Function Documentation

void AirpcapClose | ( | PAirpcapHandle | AdapterHandle | ) |

Close an adapter.

Parameters

  AdapterHandle | Handle to the adapter to close.

gboolean AirpcapConvertChannelToFrequency | ( | guint | Channel,
|  | guint * | PFrequency
| ) |  |

Converts a given channel to the corresponding frequency.

Parameters

  Channel | Channel number to be converted.
  PFrequency | Pointer to a user-supplied variable that will contain the channel frequency in MHz on success.

Returns
  TRUE on success, i.e. the given channel number exists.

gboolean AirpcapConvertFrequencyToChannel | ( | guint | Frequency,
|  | guint * | PChannel,
|  | PAirpcapChannelBand | PBand
| ) |  |

Converts a given frequency to the corresponding channel.

Parameters

  Frequency | Frequency of the channel, in MHz.
  PChannel | Pointer to a user-supplied variable that will contain the channel number on success.
  PBand | Pointer to a user-supplied variable that will contain the band (a or b/g) of the given channel.

Returns
  TRUE on success, i.e. the frequency corresponds to a valid a or b/g channel.

void AirpcapFreeDeviceList | ( | PAirpcapDeviceDescription | PAllDevs | ) |

Free a list of devices returned by AirpcapGetDeviceList()

Parameters

  PAllDevs | Head of the list of devices returned by AirpcapGetDeviceList().

gboolean AirpcapGetDecryptionState | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapDecryptionState | PEnable
| ) |  |

Tells if this open instance is configured to perform the decryption of the incoming frames with the adapter-specific keys.

Parameters

  AdapterHandle | Handle to the adapter.
  PEnable | Pointer to a user supplied variable that will contain the decryption configuration. See PAirpcapDecryptionState for details.

Returns
  TRUE if the operation is successful. FALSE otherwise.

The adapter-specific decryption keys can be configured with the AirpcapSetDeviceKeys() function.

Note
  By default, the driver is configured with AIRPCAP_DECRYPTION_ON.

gboolean AirpcapGetDeviceChannel | ( | PAirpcapHandle | AdapterHandle,
|  | guint * | PChannel
| ) |  |

Get the radio channel of a device.

Parameters

  AdapterHandle | Handle to the adapter.
  PChannel | Pointer to a user-supplied variable into which the function will copy the currently configured radio channel.

Returns
  TRUE on success.

The list of available channels can be retrieved with AirpcapGetDeviceSupportedChannels(). The default channel setting is 6.

Note
  this is a device-related function: when you change the channel from an open capture instance, the change will be immediately reflected on all the other capture instances.

gboolean AirpcapGetDeviceChannelEx | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapChannelInfo | PChannelInfo
| ) |  |

Get the channel of a device through its radiofrequency. In case of 802.11n enabled devices, it gets the extension channel, if in use.

Parameters

  AdapterHandle | Handle to the adapter.
  PChannelInfo | Pointer to a user-supplied variable into which the function will copy the currently configured channel information.

Returns
  TRUE on success.

Note
  this is a device-related function: when you change the channel from an open capture instance, the change will be immediately reflected on all the other capture instances.

gboolean AirpcapGetDeviceKeys | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapKeysCollection | KeysCollection,
|  | guint * | PKeysCollectionSize
| ) |  |

Returns the list of decryption keys in the driver that are currently associated with the specified device.

Parameters

  AdapterHandle | Handle to an open adapter instance.
  KeysCollection | User-allocated PAirpcapKeysCollection structure that will be filled with the keys.
  PKeysCollectionSize | IN: pointer to a user-allocated variable that contains the length of the KeysCollection structure, in bytes. OUT: amount of data moved by the driver in the buffer pointed by KeysBuffer, in bytes.

Returns
  TRUE if the operation is successful. If an error occurs, the return value is FALSE and KeysCollectionSize is zero. If the provided buffer is too small to contain the keys, the return value is FALSE and KeysCollectionSize contains the needed KeysCollection length, in bytes. If the device doesn't have any decryption key configured, the return value is TRUE, and KeysCollectionSize will be zero.

This function returns the adapter-specific set of keys. These keys are used by the specified adapter only, and not by other airpcap devices besides the specified one.

The AirPcap driver is able to use a set of decryption keys to decrypt the traffic transmitted on a specific SSID. If one of the keys corresponds to the one the frame has been encrypted with, the driver will perform decryption and return the cleartext frames to the application. The driver supports, for every device, multiple keys at the same time.

The configured decryption keys are device-specific, therefore AirpcapGetDeviceKeys() will return a different set of keys when called on different devices.

At this time, the only supported decryption method is WEP.

gboolean AirpcapGetDeviceList | ( | PAirpcapDeviceDescription * | PPAllDevs,
|  | gchar * | Ebuf
| ) |  |

Return the list of available devices.

Parameters

  PPAllDevs | Address to a caller allocated pointer. On success this pointer will receive the head of a list of available devices.
  Ebuf | String that will contain error information if FALSE is returned. The size of the string must be AIRPCAP_ERRBUF_SIZE bytes.

Returns
  TRUE on success. FALSE is returned on failure, in which case Ebuf is filled in with an appropriate error message.

Here's a snippet of code that shows how to use AirpcapGetDeviceList():

1 gchar Ebuf[AIRPCAP_ERRBUF_SIZE];
2 AirpcapDeviceDescription *Desc, *tDesc;
3
4 if(AirpcapGetDeviceList(&Desc, Ebuf) == -1)
5 {
6 printf("Unable to get the list of devices: %s\n", Ebuf);
7 return -1;
8 }
9
10 for(tDesc = Desc; tDesc; tDesc = tDesc->next)
11 {
12 printf("%u) %s (%s)\n",
13 ++i,
14 tDesc->Name,
15 tDesc->Description);
16 }
17
18 AirpcapFreeDeviceList(Desc);

gboolean AirpcapGetDeviceSupportedChannels | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapChannelInfo * | ppChannelInfo,
|  | guint * | pNumChannelInfo
| ) |  |

Get the list of supported channels for a given device. In case of a 802.11n capable device, information related to supported extension channels is also reported.

Every control channel is listed multiple times, one for each different supported extension channel. For example channel 6 (2437MHz) is usually listed three times:

- Frequency 2437 Extension +1. Control channel is 6, extension channel is 10.
- Frequency 2437 Extension 0. Control channel is 6, no extension channel is used (20MHz channel and legacy mode).
- Frequency 2437 Extension -1. Control channel is 6, extension channel is 2.
  Parameters

    AdapterHandle | Handle to the adapter.
    ppChannelInfo | Pointer to a user-supplied variable that will point to an array of supported channel. Such list must not be freed by the caller
    pNumChannelInfo | Number of channels returned in the array.

  Returns
    TRUE on success.
  Note
    The supported channels are not listed in any specific order.

gboolean AirpcapGetDriverDecryptionState | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapDecryptionState | PEnable
| ) |  |

Tells if this open instance is configured to perform the decryption of the incoming frames with the global driver set of keys.

Parameters

  AdapterHandle | Handle to the adapter.
  PEnable | Pointer to a user supplied variable that will contain the decryption configuration. See PAirpcapDecryptionState for details.

Returns
  TRUE if the operation is successful. FALSE otherwise.

The global decryption keys can be configured with the AirpcapSetDriverKeys() function.

Note
  By default, the driver is configured with AIRPCAP_DECRYPTION_ON.

gboolean AirpcapGetDriverKeys | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapKeysCollection | KeysCollection,
|  | guint * | PKeysCollectionSize
| ) |  |

Returns the global list of decryption keys in the driver that are associated with all the devices.

Parameters

  AdapterHandle | Handle to an open adapter instance.
  KeysCollection | User-allocated PAirpcapKeysCollection structure that will be filled with the keys.
  PKeysCollectionSize | IN: pointer to a user-allocated variable that contains the length of the KeysCollection structure, in bytes. OUT: amount of data moved by the driver in the buffer pointed by KeysBuffer, in bytes.

Returns
  TRUE if the operation is successful. If an error occurs, the return value is FALSE and KeysCollectionSize is zero. If the provided buffer is too small to contain the keys, the return value is FALSE and KeysCollectionSize contains the needed KeysCollection length, in bytes. If the device doesn't have any decryption key configured, the return value is TRUE, and KeysCollectionSize will be zero.

This function returns the global driver set of keys. These keys will be used by all the adapters plugged in the machine.

The AirPcap driver is able to use a set of decryption keys to decrypt the traffic transmitted on a specific SSID. If one of the keys corresponds to the one the frame has been encrypted with, the driver will perform decryption and return the cleartext frames to the application.

At this time, the only supported decryption method is WEP.

gboolean AirpcapGetFcsPresence | ( | PAirpcapHandle | AdapterHandle,
|  | gboolean * | PIsFcsPresent
| ) |  |

Returns TRUE if the specified adapter includes the MAC Frame Check Sequence in the captured packets.

Parameters

  AdapterHandle | Handle to the adapter.
  PIsFcsPresent | User-provided variable that will be set to true if the adapter is including the FCS.

Returns
  TRUE if the operation is successful. FALSE otherwise.

In the default configuration, the adapter has FCS inclusion turned on. The MAC Frame Check Sequence is 4 bytes and is located at the end of the 802.11 packet, with both AIRPCAP_LT_802_11 and AIRPCAP_LT_802_11_PLUS_RADIO link types. When the FCS inclusion is turned on, and if the link type is AIRPCAP_LT_802_11_PLUS_RADIO, the radiotap header that precedes each frame has two additional fields at the end: Padding and FCS. These two fields are not present when FCS inclusion is off.

gboolean AirpcapGetFcsValidation | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapValidationType | ValidationType
| ) |  |

Checks if the specified adapter is configured to capture frames with incorrect an incorrect Frame Check Sequence (FCS).

Parameters

  AdapterHandle | Handle to the adapter.
  ValidationType | Pointer to a user supplied variable that will contain the type of validation the driver will perform. See the documentation of AirpcapValidationType for details.

Returns
  TRUE if the operation is successful. FALSE otherwise.

Note
  By default, the driver is configured in AIRPCAP_VT_ACCEPT_EVERYTHING mode.

gboolean AirpcapGetKernelBufferSize | ( | PAirpcapHandle | AdapterHandle,
|  | guint * | PSizeBytes
| ) |  |

Get the size of the kernel packet buffer for this adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  PSizeBytes | User-allocated variable that will be filled with the size of the kernel buffer.

Returns
  TRUE on success.

Every AirPcap open instance has an associated kernel buffer, whose default size is 1 Mbyte. This function can be used to get the size of this buffer.

gchar* AirpcapGetLastError | ( | PAirpcapHandle | AdapterHandle | ) |

Return the last error related to the specified handle.

Parameters

  AdapterHandle | Handle to an open adapter.

Returns
  The string with the last error.

gboolean AirpcapGetLedsNumber | ( | PAirpcapHandle | AdapterHandle,
|  | guint * | NumberOfLeds
| ) |  |

Get the number of LEDs the referenced adapter has available.

Parameters

  AdapterHandle | Handle to the adapter.
  NumberOfLeds | Number of LEDs available on this adapter.

Returns
  TRUE on success.

gboolean AirpcapGetLinkType | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapLinkType | PLinkType
| ) |  |

Get the link type of the specified adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  PLinkType | Pointer to a caller allocated AirpcapLinkType variable that will contain the link type of the adapter.

Returns
  TRUE on success.

the "link type" determines how the driver will encode the packets captured from the network. Aircap supports two link types:

- AIRPCAP_LT_802_11, to capture 802.11 frames (including control frames) without any power information. Look at the Capture_no_radio example application in the developer's pack for a reference on how to decode 802.11 frames with this link type.
- AIRPCAP_LT_802_11_PLUS_RADIO, to capture 802.11 frames (including control frames) with a radiotap header that contains power and channel information. More information about the radiotap header can be found int the radiotap section. Moreover, the "Capture_radio" example application in the developer's pack can be used as a reference on how to decode 802.11 frames with radiotap headers.

gboolean AirpcapGetMacAddress | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapMacAddress | PMacAddress
| ) |  |

Return the MAC address of an adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  PMacAddress | Pointer to a user allocated MAC address. The size of this buffer needs to be at least 6 bytes.

Returns
  TRUE on success.

gboolean AirpcapGetMonitorMode | ( | PAirpcapHandle | AdapterHandle,
|  | gboolean * | PMonitorModeEnabled
| ) |  |

Returns TRUE if the specified adapter is in monitor mode.

Parameters

  AdapterHandle | Handle to the adapter.
  PMonitorModeEnabled | User-provided variable that will be set to true if the adapter is in monitor mode.

Returns
  TRUE if the operation is successful. FALSE otherwise.

Note
  When an adapter is plugged into the system, it's always configured with monitor mode ON. The monitor mode configuration is not stored persistently, so if you want to turn monitor mode off, you will need to do it every time you open the adapter.

gboolean AirpcapGetReadEvent | ( | PAirpcapHandle | AdapterHandle,
|  | void *** | PReadEvent
| ) |  |

Gets an event that is signaled when that is signalled when packets are available in the kernel buffer (see AirpcapSetMinToCopy()).

Parameters

  AdapterHandle | Handle to the adapter.
  PReadEvent | Pointer to a user-supplied handle that in which the read event will be copied.

Returns
  TRUE on success.

Note
  the event is signalled when at least mintocopy bytes are present in the kernel buffer (see AirpcapSetMinToCopy()). This event can be used by WaitForSingleObject() and WaitForMultipleObjects() to create blocking behavior when reading packets from one or more adapters (see AirpcapRead()).

gboolean AirpcapGetStats | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapStats | PStats
| ) |  |

Get per-adapter WinPcap-compatible capture statistics.

Parameters

  AdapterHandle | Handle to the adapter.
  PStats | pointer to a user-allocated AirpcapStats structure that will be filled with statistical information.

Returns
  TRUE on success.

void AirpcapGetVersion | ( | guint * | VersionMajor,
|  | guint * | VersionMinor,
|  | guint * | VersionRev,
|  | guint * | VersionBuild
| ) |  |

Return a string with the API version.

Parameters

  VersionMajor | Pointer to a variable that will be filled with the major version number.
  VersionMinor | Pointer to a variable that will be filled with the minor version number.
  VersionRev | Pointer to a variable that will be filled with the revision number.
  VersionBuild | Pointer to a variable that will be filled with the build number.

PAirpcapHandle AirpcapOpen | ( | gchar * | DeviceName,
|  | gchar * | Ebuf
| ) |  |

Open an adapter.

Parameters

  DeviceName | Name of the device to open. Use AirpcapGetDeviceList() to get the list of devices.
  Ebuf | String that will contain error information in case of failure. The size of the string must be AIRPCAP_ERRBUF_SIZE bytes.

Returns
  A PAirpcapHandle handle on success. NULL is returned on failure, in which case Ebuf is filled in with an appropriate error message.

gboolean AirpcapRead | ( | PAirpcapHandle | AdapterHandle,
|  | guint8 * | Buffer,
|  | guint | BufSize,
|  | guint * | PReceievedBytes
| ) |  |

Fills a user-provided buffer with zero or more packets that have been captured on the referenced adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  Buffer | pointer to the buffer that will be filled with captured packets.
  BufSize | size of the input buffer that will contain the packets, in bytes.
  PReceievedBytes | Pointer to a user supplied variable that will receive the number of bytes copied by AirpcapRead. Can be smaller than BufSize.

Returns
  TRUE on success.

802.11 frames are returned by the driver in buffers. Every 802.11 frame in the buffer is preceded by a AirpcapBpfHeader structure. The suggested way to use an AirPcap adapter is through the pcap API exported by wpcap.dll. If this is not possible, the Capture_radio and Capture_no_radio examples in the AirPcap developer's pack show how to properly decode the packets in the read buffer returned by AirpcapRead().

Note
  this function is NOT blocking. Blocking behavior can be obtained using the event returned by AirpcapGetReadEvent(). See also AirpcapSetMinToCopy().

gboolean AirpcapSetDecryptionState | ( | PAirpcapHandle | AdapterHandle,
|  | AirpcapDecryptionState | Enable
| ) |  |

Turns on or off the decryption of the incoming frames with the adapter-specific keys.

Parameters

  AdapterHandle | Handle to the adapter.
  Enable | Either AIRPCAP_DECRYPTION_ON or AIRPCAP_DECRYPTION_OFF

Returns
  TRUE on success.

The adapter-specific decryption keys can be configured with the AirpcapSetDeviceKeys() function.

Note
  By default, the driver is configured with AIRPCAP_DECRYPTION_ON.

gboolean AirpcapSetDeviceChannel | ( | PAirpcapHandle | AdapterHandle,
|  | guint | Channel
| ) |  |

Set the radio channel of a device.

Parameters

  AdapterHandle | Handle to the adapter.
  Channel | the new channel to set.

Returns
  TRUE on success.

The list of available channels can be retrieved with AirpcapGetDeviceSupportedChannels(). The default channel setting is 6.

Note
  this is a device-related function: when you change the channel from an open capture instance, the change will be immediately reflected on all the other capture instances.

gboolean AirpcapSetDeviceChannelEx | ( | PAirpcapHandle | AdapterHandle,
|  | AirpcapChannelInfo | ChannelInfo
| ) |  |

Set the channel of a device through its radio frequency. In case of 802.11n enabled devices, it sets the extension channel, if used.

Parameters

  AdapterHandle | Handle to the adapter.
  ChannelInfo | The new channel information to set.

Returns
  TRUE on success.

Note
  this is a device-related function: when you change the channel from an open capture instance, the change will be immediately reflected on all the other capture instances.

gboolean AirpcapSetDeviceKeys | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapKeysCollection | KeysCollection
| ) |  |

Set the list of decryption keys that the driver is going to use with the specified device.

Parameters

  AdapterHandle | Handle an open adapter instance.
  KeysCollection | Pointer to a PAirpcapKeysCollection structure that contains the keys to be set in the driver.

Returns
  TRUE if the operation is successful. FALSE otherwise.

The AirPcap driver is able to use a set of decryption keys to decrypt the traffic transmitted on a specific SSID. If one of the keys corresponds to the one the frame has been encrypted with, the driver will perform decryption and return the cleartext frames to the application.

This function allows to set the adapter-specific set of keys. These keys will be used by the specified adapter only, and will not be used by other airpcap devices besides the specified one.

At this time, the only supported decryption method is WEP.

The keys are applied to the packets in the same order they appear in the KeysCollection structure until the packet is correctly decrypted, therefore putting frequently used keys at the beginning of the structure improves performance.

Note
  : when you change the set of keys from an open capture instance, the change will be immediately reflected on all the other capture instances.

gboolean AirpcapSetDriverDecryptionState | ( | PAirpcapHandle | AdapterHandle,
|  | AirpcapDecryptionState | Enable
| ) |  |

Turns on or off the decryption of the incoming frames with the global driver set of keys.

Parameters

  AdapterHandle | Handle to the adapter.
  Enable | Either AIRPCAP_DECRYPTION_ON or AIRPCAP_DECRYPTION_OFF

Returns
  TRUE on success.

The global decryption keys can be configured with the AirpcapSetDriverKeys() function.

Note
  By default, the driver is configured with AIRPCAP_DECRYPTION_ON.

gboolean AirpcapSetDriverKeys | ( | PAirpcapHandle | AdapterHandle,
|  | PAirpcapKeysCollection | KeysCollection
| ) |  |

Set the global list of decryption keys that the driver is going to use with all the devices.

Parameters

  AdapterHandle | Handle an open adapter instance.
  KeysCollection | Pointer to a PAirpcapKeysCollection structure that contains the keys to be set in the driver.

Returns
  TRUE if the operation is successful. FALSE otherwise.

The AirPcap driver is able to use a set of decryption keys to decrypt the traffic transmitted on a specific SSID. If one of the keys corresponds to the one the frame has been encrypted with, the driver will perform decryption and return the cleartext frames to the application.

This function allows to set the global driver set of keys. These keys will be used by all the adapters plugged in the machine.

At this time, the only supported decryption method is WEP.

The keys are applied to the packets in the same order they appear in the KeysCollection structure until the packet is correctly decrypted, therefore putting frequently used keys at the beginning of the structure improves performance.

Note
  : when you change the set of keys from an open capture instance, the change will be immediately reflected on all the other capture instances.

gboolean AirpcapSetFcsPresence | ( | PAirpcapHandle | AdapterHandle,
|  | gboolean | IsFcsPresent
| ) |  |

Configures the adapter on whether to include the MAC Frame Check Sequence in the captured packets.

Parameters

  AdapterHandle | Handle to the adapter.
  IsFcsPresent | TRUE if the packets should include the FCS. FALSE otherwise

Returns
  TRUE on success.

In the default configuration, the adapter includes the FCS in the captured packets. The MAC Frame Check Sequence is 4 bytes and is located at the end of the 802.11 packet, with both AIRPCAP_LT_802_11 and AIRPCAP_LT_802_11_PLUS_RADIO link types. When the FCS inclusion is turned on, and if the link type is AIRPCAP_LT_802_11_PLUS_RADIO, the radiotap header that precedes each frame has two additional fields at the end: Padding and FCS. These two fields are not present when FCS inclusion is off.

gboolean AirpcapSetFcsValidation | ( | PAirpcapHandle | AdapterHandle,
|  | AirpcapValidationType | ValidationType
| ) |  |

Configures the adapter to accept or drop frames with an incorrect Frame Check sequence (FCS).

Parameters

  AdapterHandle | Handle to the adapter.
  ValidationType | The type of validation the driver will perform. See the documentation of AirpcapValidationType for details.

Returns
  TRUE on success.

Note
  By default, the driver is configured in AIRPCAP_VT_ACCEPT_EVERYTHING mode.

gboolean AirpcapSetFilter | ( | PAirpcapHandle | AdapterHandle,
|  | void * | Instructions,
|  | guint | Len
| ) |  |

Set the BPF kernel filter for an adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  Instructions | pointer to the first BPF instruction in the array. Corresponds to the bf_insns in a bpf_program structure (see the WinPcap documentation at https://www.winpcap.org/devel.htm).
  Len | Number of instructions in the array pointed by the previous field. Corresponds to the bf_len in a a bpf_program structure (see the WinPcap documentation at https://www.winpcap.org/devel.htm).

Returns
  TRUE on success.

The AirPcap driver is able to perform kernel-level filtering using the standard BPF pseudo-machine format. You can read the WinPcap documentation at https://www.winpcap.org/devel.htm for more details on the BPF filtering mechanism.

A filter can be automatically created by using the pcap_compile() function of the WinPcap API. This function converts a human readable text expression with the tcpdump/libpcap syntax into a BPF program. If your program doesn't link wpcap, but you need to generate the code for a particular filter, you can run WinDump with the -d or -dd or -ddd flags to obtain the pseudocode.

gboolean AirpcapSetKernelBuffer | ( | PAirpcapHandle | AdapterHandle,
|  | guint | BufferSize
| ) |  |

Set the size of the kernel packet buffer for this adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  BufferSize | New size, in bytes.

Returns
  TRUE on success.

Every AirPcap open instance has an associated kernel buffer, whose default size is 1 Mbyte. This function can be used to change the size of this buffer, and can be called at any time. A bigger kernel buffer size decreases the risk of dropping packets during network bursts or when the application is busy, at the cost of higher kernel memory usage.

Note
  don't use this function unless you know what you are doing. Due to caching issues and bigger non-paged memory consumption, bigger buffer sizes can decrease the capture performance instead of improving it.

gboolean AirpcapSetLinkType | ( | PAirpcapHandle | AdapterHandle,
|  | AirpcapLinkType | NewLinkType
| ) |  |

Set the link type of an adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  NewLinkType | the "link type", i.e. the format of the frames that will be received from the adapter.

Returns
  TRUE on success.

the "link type" determines how the driver will encode the packets captured from the network. Aircap supports two link types:

- AIRPCAP_LT_802_11, to capture 802.11 frames (including control frames) without any power information. Look at the Capture_no_radio example application in the developer's pack for a reference on how to decode 802.11 frames with this link type.
- AIRPCAP_LT_802_11_PLUS_RADIO, to capture 802.11 frames (including control frames) with a radiotap header that contains power and channel information. More information about the radiotap header can be found in the radiotap section. Moreover, the "Capture_radio" example application in the developer's pack can be used as a reference on how to decode 802.11 frames with radiotap headers.
- AIRPCAP_LT_802_11_PLUS_PPI, to capture 802.11 frames (including control frames) with a Per Packet Information (PPI) header that contains per-packet meta information like channel and power information. More details on the PPI header can be found in the PPI online documentation (TODO).

gboolean AirpcapSetMinToCopy | ( | PAirpcapHandle | AdapterHandle,
|  | guint | MinToCopy
| ) |  |

Set the mintocopy parameter for an open adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  MinToCopy | is the mintocopy size in bytes.

Returns
  TRUE on success.

When the number of bytes in the kernel buffer changes from less than mintocopy bytes to greater than or equal to mintocopy bytes, the read event is signalled (see AirpcapGetReadEvent()). A high value for mintocopy results in poor responsiveness since the driver may signal the application "long" after the arrival of the packet. And a high value results in low CPU loading by minimizing the number of user/kernel context switches. A low MinToCopy results in good responsiveness since the driver will signal the application close to the arrival time of the packet. This has higher CPU loading over the first approach.

gboolean AirpcapSetMonitorMode | ( | PAirpcapHandle | AdapterHandle,
|  | gboolean | MonitorModeEnabled
| ) |  |

Sets the monitor mode for the specified adapter.

Parameters

  AdapterHandle | Handle to the adapter.
  MonitorModeEnabled | If TRUE, the adapter will be put in monitor mode. If FALSE, the adapter will be configured for normal operation.

Returns
  TRUE on success.

When monitor mode is on, the adapter captures all the packets transmitted on the channel. This includes:

- unicast packets
- multicast packets
- broadcast packets
- control and management packets

When monitor mode is off, the adapter has a filter on unicast packets to capture only the packets whose MAC destination address equals to the adapter's address. This means the following frames will be received:

- unicast packets with the address of the adapter
- multicast packets
- broadcast packets
- beacons and probe requests

The main reason to turn monitor mode off is that, when not in monitor mode, the adapter will acknowledge the data frames sent to its address. This is useful when the adapter needs to interact with other devices on the 802.11 network, because handling the ACKs in software is too slow.

Note
  When an adapter is plugged into the system, it's always configured with monitor mode ON. The monitor mode configuration is not stored persistently, so if you want to turn monitor mode off, you will need to do it every time you open the adapter.

gboolean AirpcapStoreCurConfigAsAdapterDefault | ( | PAirpcapHandle | AdapterHandle | ) |

Saves the configuration of the specified adapter in the registry, so that it becomes the default for this adapter.

Parameters

  AdapterHandle | Handle to the adapter.

Returns
  TRUE on success. FALSE on failure.

Almost all the AirPcap calls that modify the configuration (AirpcapSetLinkType(), AirpcapSetFcsPresence(), AirpcapSetFcsValidation(), AirpcapSetKernelBuffer(), AirpcapSetMinToCopy()) affect only the referenced AirPcap open instance. This means that if you do another AirpcapOpen() on the same adapter, the configuration changes will not be remembered, and the new adapter handle will have default configuration settings.

Exceptions to this rule are the AirpcapSetDeviceChannel() and AirpcapSetDeviceKeys() functions: a channel change is reflected on all the open instances, and remembered until the next call to AirpcapSetDeviceChannel(), until the adapter is unplugged, or until the machine is powered off. Same thing for the configuration of the WEP keys.

AirpcapStoreCurConfigAsAdapterDefault() stores the configuration of the give open instance as the default for the adapter: all the instances opened in the future will have the same configuration that this adapter currently has. The configuration is stored in the registry, therefore it is remembered even when the adapter is unplugged or the machine is turned off. However, an adapter doesn't bring its configuration with it from machine to machine.

the configuration information saved in the registry includes the following parameters:

- channel
- kernel buffer size
- mintocopy
- link type
- CRC presence
- Encryption keys
- Encryption Enabled/Disabled state

The configuration is adapter-specific. This means that changing the configuration of an adapter doesn't modify the one of the other adapters that are currently used or that will be used in the future.

Note
  AirpcapStoreCurConfigAsAdapterDefault() must have exclusive access to the adapter – it will fail if more than one AirPcap handle is opened at the same time for this adapter. AirpcapStoreCurConfigAsAdapterDefault() needs administrator privileges. It will fail if the calling user is not a local machine administrator.

gboolean AirpcapTurnLedOff | ( | PAirpcapHandle | AdapterHandle,
|  | guint | LedNumber
| ) |  |

Turn off one of the adapter's LEDs.

Parameters

  AdapterHandle | Handle to the adapter.
  LedNumber | zero-based identifier of the LED to turn off.

Returns
  TRUE on success.

gboolean AirpcapTurnLedOn | ( | PAirpcapHandle | AdapterHandle,
|  | guint | LedNumber
| ) |  |

Turn on one of the adapter's LEDs.

Parameters

  AdapterHandle | Handle to the adapter.
  LedNumber | zero-based identifier of the LED to turn on.

Returns
  TRUE on success.

gboolean AirpcapWrite | ( | PAirpcapHandle | AdapterHandle,
|  | gchar * | TxPacket,
|  | guint32 | PacketLen
| ) |  |

Transmits a packet.

Parameters

  AdapterHandle | Handle to the adapter.
  TxPacket | Pointer to a buffer that contains the packet to be transmitted.
  PacketLen | Length of the buffer pointed by the TxPacket argument, in bytes.

Returns
  TRUE on success.

The packet will be transmitted on the channel the device is currently set. To change the device adapter, use the AirpcapSetDeviceChannel() function.

If the linktype of the adapter is AIRPCAP_LT_802_11, the buffer pointed by TxPacket should contain just the 802.11 packet, without additional information. The packet will be transmitted at 1Mbps.

If the linktype of the adapter is AIRPCAP_LT_802_11_PLUS_RADIO, the buffer pointed by TxPacket should contain a radiotap header followed by the 802.11 packet. AirpcapWrite will use the rate information in the radiotap header when transmitting the packet.