PCAP_LOOKUPDEV(3)

💅 PCAP_LOOKUPDEV(3) — default-capture-device energy ✨

okay so this page is from the Library Functions Manual, and it’s all about pcap_lookupdev — the little function whose whole job is finding the default device on which to capture. She’s iconic, but she’s also deprecated, so buckle up bestie 🫶

---

💖 NAME 💖

pcap_lookupdev — find the default device on which to capture.

---

✨ SYNOPSIS ✨

#include <pcap/pcap.h>

char errbuf[PCAP_ERRBUF_SIZE];

[DEPRECATED] char *pcap_lookupdev(char *errbuf);

🚨 DEPRECATED alert — this interface is obsoleted by pcap_findalldevs(3). Like, use the new one, fr fr.

---

🦋 DESCRIPTION 🦋

So pcap_lookupdev has been obsoleted by pcap_findalldevs(3). The modern-era move is: call pcap_findalldevs() and, if the list it returns is not empty, use the first device in the list. If the list is empty, there are no devices on which capture is possible. That’s it, that’s the tea ☕

errbuf is a buffer large enough to hold at least PCAP_ERRBUF_SIZE chars. Think of it as the little notepad where the function writes its error message if things go sideways 📝

Also, plot twist: if pcap_init(3) has been called, this interface always returns NULL. No device name, no drama, just NULL 💀

pcap_lookupdev() returns a pointer to a string giving the name of a network device suitable for use with pcap_create(3) and pcap_activate(3), or with pcap_open_live(3), and with pcap_lookupnet(3). If there is an error, or if pcap_init(3) has been called, NULL is returned and errbuf is filled in with an appropriate error message. So like, if you get NULL, check errbuf, bestie 🫶

---

🌈 SEE ALSO 🌈

• pcap(3) — the main character, the whole pcap vibe.

---

💀 BUGS 💀

• The pointer returned by pcap_lookupdev() points to a static buffer. That means subsequent calls to pcap_lookupdev() in the same thread, or calls to pcap_lookupdev() in another thread, may overwrite that buffer. So don’t be surprised if your string gets snatched by another call — it’s giving shared-buffer chaos 😭
• In WinPcap and Npcap, this function may return a UTF-16 string rather than an ASCII or UTF-8 string. So if the encoding looks weird, that’s why — it’s not you, it’s the platform 🙈

---

mwah 💋 this page is from 30 November 2023 and signs off as PCAP_LOOKUPDEV(3) — periodt. 🎀