+----------------------------------------------------------------------------+ | | | This man page documents libpcap version 1.10.1. | | | | Your system may have a different version installed, possibly with some | | local modifications. To achieve the best results, please make sure this | | version of this man page suits your needs. If necessary, try to look for | | a different version on this web site or in the man pages available in your | | installation. | | | +----------------------------------------------------------------------------+ PCAP_OPEN_LIVE(3PCAP) PCAP_OPEN_LIVE(3PCAP) NAME pcap_open_live - open a device for capturing SYNOPSIS #include char errbuf[PCAP_ERRBUF_SIZE]; pcap_t *pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, char *errbuf); DESCRIPTION pcap_open_live() is used to obtain a packet capture handle to look at packets on the network. device is a string that specifies the network device to open; on Linux systems with 2.2 or later kernels, a device argument of "any" or NULL can be used to capture packets from all in- terfaces. snaplen specifies the snapshot length to be set on the handle. promisc specifies whether the interface is to be put into promiscuous mode. If promisc is non-zero, promiscuous mode will be set, otherwise it will not be set. to_ms specifies the packet buffer timeout, as a non-negative value, in milliseconds. (See pcap(3PCAP) for an explanation of the packet buffer timeout.) RETURN VALUE pcap_open_live() returns a pcap_t * on success and NULL on failure. If NULL is returned, errbuf is filled in with an appropriate error mes- sage. errbuf may also be set to warning text when pcap_open_live() succeeds; to detect this case the caller should store a zero-length string in errbuf before calling pcap_open_live() and display the warn- ing to the user if errbuf is no longer a zero-length string. errbuf is assumed to be able to hold at least PCAP_ERRBUF_SIZE chars. SEE ALSO pcap_create(3PCAP), pcap_activate(3PCAP) 6 December 2017 PCAP_OPEN_LIVE(3PCAP)