pcap_open_dead(3PCAP) man page

Updated: 3 January 2014 • View in plain textReturn to Main Contents

This man page documents libpcap version 1.10.4 (see also: git master branch, 1.10.2, 1.10.1, 1.10.0, 1.9.1, 1.8.1, 1.7.4, 1.6.2, 1.5.3).

Your system may have a different version installed, possibly with some local modifications. To achieve the best results, please make sure this version of this man page suits your needs. If necessary, try to look for a different version on this web site or in the man pages available in your installation.

NAME

pcap_open_dead, pcap_open_dead_with_tstamp_precision - open a fake pcap_t for compiling filters or opening a capture for output

SYNOPSIS

#include <pcap/pcap.h>

pcap_t *pcap_open_dead(int linktype, int snaplen);
pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,
    u_int precision);

DESCRIPTION

pcap_open_dead() and pcap_open_dead_with_tstamp_precision() are used for creating a pcap_t structure to use when calling the other functions in libpcap. It is typically used when just using libpcap for compiling BPF code; it can also be used if using pcap_dump_open(3PCAP), pcap_dump(3PCAP), and pcap_dump_close(3PCAP) to write a savefile if there is no pcap_t that supplies the packets to be written.

linktype specifies the link-layer type for the pcap_t.

snaplen specifies the snapshot length for the pcap_t.

When pcap_open_dead_with_tstamp_precision(), is used to create a pcap_t for use with pcap_dump_open(), precision specifies the time stamp precision for packets; PCAP_TSTAMP_PRECISION_MICRO should be specified if the packets to be written have time stamps in seconds and microseconds, and PCAP_TSTAMP_PRECISION_NANO should be specified if the packets to be written have time stamps in seconds and nanoseconds. Its value does not affect pcap_compile(3PCAP).

BACKWARD COMPATIBILITY

The pcap_open_dead_with_tstamp_precision() function became available in libpcap release 1.5.1. In previous releases, there was no mechanism to open a savefile for writing with time stamps given in seconds and nanoseconds.

SEE ALSO

pcap(3PCAP), pcap-linktype(7)


COLOPHON

This HTML man page was generated at 21:18:21 GMT, April 07, 2023 from a source man page in "The Tcpdump Group" git repositories using man2html and other tools.