Manpages - pcap_open_dead.3pcap

pcap_open_dead, pcap_open_dead_with_tstamp_precision - open a fake pcap_t for compiling filters or opening a capture for output

  #include <pcap/pcap.h>
  pcap_t *pcap_open_dead(int linktype, int snaplen);
  pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,
      u_int precision);

pcap_open_dead*() and *pcap_open_dead_with_tstamp_precision*() are used for creating a *pcap_t structure to use when calling the other functions in libpcap. It is typically used when just using libpcap for compiling BPF code; it can also be used if using pcap_dump_open*(3PCAP), *pcap_dump*(3PCAP), and *pcap_dump_close*(3PCAP) to write a savefile if there is no *pcap_t that supplies the packets to be written.

linktype specifies the link-layer type for the pcap_t.

snaplen specifies the snapshot length for the pcap_t.

When pcap_open_dead_with_tstamp_precision*(), is used to create a *pcap_t for use with pcap_dump_open*(), precision specifies the time stamp precision for packets; *PCAP_TSTAMP_PRECISION_MICRO should be specified if the packets to be written have time stamps in seconds and microseconds, and PCAP_TSTAMP_PRECISION_NANO should be specified if the packets to be written have time stamps in seconds and nanoseconds. Its value does not affect *pcap_compile*(3PCAP).

The *pcap_open_dead_with_tstamp_precision*() function became available in libpcap release 1.5.1. In previous releases, there was no mechanism to open a savefile for writing with time stamps given in seconds and nanoseconds.

*pcap*(3PCAP), *pcap-linktype*(7)