PCAP_OFFLINE_FILTER(3)

💅 pcap_offline_filter — bestie, does this packet match the filter or not?? 💅

okay so bestie, welcome to pcap_offline_filter(3) from the Library Functions Manual — this is the function you call when you literally just wanna know if a packet vibes with your filter. no cap. ✨

---

🌸 NAME 🌸

pcap_offline_filter — check whether a filter matches a packet 🎀

---

🦋 SYNOPSIS 🦋

#include <pcap/pcap.h>

int pcap_offline_filter(const struct bpf_program *fp,
    const struct pcap_pkthdr *h, const u_char *pkt);

---

💖 DESCRIPTION 💖

okay so like, pcap_offline_filter() checks whether a filter matches a packet. that's the whole vibe. 🫶

• fp — pointer to a bpf_program struct, usually the result of a call to pcap_compile(3). it's giving "i was compiled just for this" energy 👑
• h — points to the pcap_pkthdr structure for the packet 📋
• pkt — points to the data in the packet, like the actual packet payload bestie 🍓

---

🔥 RETURN VALUE 🔥

pcap_offline_filter() returns the return value of the filter program, periodt. 💅

• zero → the packet doesn't match the filter 🙈
• non-zero → the packet matches the filter 🎉

literally that simple, no plot twist. ⭐

---

🌈 SEE ALSO 🌈

• pcap(3) — the main character of this whole ecosystem 👑

---

mwah — this lil page is from 7 April 2014, brought to you by the PCAP_OFFLINE_FILTER(3) manual, part of the Library Functions Manual. go forth and filter, bestie 💜✨