PCAP_DUMP_FTELL(3)

okay bestie, welcome to the PCAP_DUMP_FTELL(3) page from the Library Functions Manual — it’s the one about checking the current file offset of a savefile while you’re writing it. short, sweet, and lowkey essential 💖

✨ NAME ✨

pcap_dump_ftell, pcap_dump_ftell64 — get the current file offset for a savefile being written. periodt.

🌸 SYNOPSIS 🌸

#include <pcap/pcap.h>

long pcap_dump_ftell(pcap_dumper_t *p);
int64_t pcap_dump_ftell64(pcap_dumper_t *p);

no cap, that’s the whole include-and-call situation 🎀

💖 DESCRIPTION 💖

okay so pcap_dump_ftell() returns the current file position for the savefile — the number of bytes written by pcap_dump_open(3) and pcap_dump(3). it’s giving “where are we rn” energy for your output file ✨.

if something goes wrong, PCAP_ERROR is returned. and here’s the part to pay attention to: if the current file position does not fit in a long, it will be truncated. this can happen on 32-bit UNIX-like systems with large file support and on Windows. not me warning you about a sneaky little truncation 😭.

then we have pcap_dump_ftell64(): it returns the current file position in an int64_t, so if file offsets that don’t fit in a long but that fit in an int64_t are supported, this will return the file offset without truncation. iconic. and yes, PCAP_ERROR is returned on error here too 💅.

🦋 BACKWARD COMPATIBILITY 🦋

the function pcap_dump_ftell64() became available in libpcap release 1.9.0. in previous releases, there was no mechanism to obtain a file offset that is too large to fit in a long. so if you’re on an older release and need that big-offset lifestyle, bestie… that’s just not a thing there 🫶.

🎀 SEE ALSO 🎀

• pcap(3) — go read it for the full libpcap vibe 🌈

signed with love by the PCAP_DUMP_FTELL(3) girlies on 25 July 2018, straight outta the Library Functions Manual 💅✨