pcap_open_dead(3PCAP) man page

Updated: 3 January 2014 • View in plain textReturn to Main Contents

This man page documents libpcap version 1.10.2 (see also: git master branch, 1.10.4, 1.10.1, 1.10.0, 1.9.1, 1.8.1, 1.7.4, 1.6.2, 1.5.3).

Your system may have a different version installed, possibly with some local modifications. To achieve the best results, please make sure this version of this man page suits your needs. If necessary, try to look for a different version on this web site or in the man pages available in your installation.


pcap_open_dead, pcap_open_dead_with_tstamp_precision - open a fake pcap_t for compiling filters or opening a capture for output


#include <pcap/pcap.h>

pcap_t *pcap_open_dead(int linktype, int snaplen);
pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,
    u_int precision);


pcap_open_dead() and pcap_open_dead_with_tstamp_precision() are used for creating a pcap_t structure to use when calling the other functions in libpcap. It is typically used when just using libpcap for compiling BPF code; it can also be used if using pcap_dump_open(3PCAP), pcap_dump(3PCAP), and pcap_dump_close(3PCAP) to write a savefile if there is no pcap_t that supplies the packets to be written.

linktype specifies the link-layer type for the pcap_t.

snaplen specifies the snapshot length for the pcap_t.

When pcap_open_dead_with_tstamp_precision(), is used to create a pcap_t for use with pcap_dump_open(), precision specifies the time stamp precision for packets; PCAP_TSTAMP_PRECISION_MICRO should be specified if the packets to be written have time stamps in seconds and microseconds, and PCAP_TSTAMP_PRECISION_NANO should be specified if the packets to be written have time stamps in seconds and nanoseconds. Its value does not affect pcap_compile(3PCAP).


The pcap_open_dead_with_tstamp_precision() function became available in libpcap release 1.5.1. In previous releases, there was no mechanism to open a savefile for writing with time stamps given in seconds and nanoseconds.


pcap(3PCAP), pcap-linktype(7)


This HTML man page was generated at 15:42:08 GMT, December 31, 2022 from a source man page in "The Tcpdump Group" git repositories using man2html and other tools.