PCAP_OPEN_DEAD(3)

💖 PCAP_OPEN_DEAD(3) 💖

okay so this page lives in the Library Functions Manual, and it's giving “I need a fake pcap_t and I need it now” energy. The two icons here are pcap_open_dead and pcap_open_dead_with_tstamp_precision, and no cap, they're for opening a fake pcap_t so you can compile filters or open a capture for output. 🫶

✨ NAME ✨

pcap_open_dead, pcap_open_dead_with_tstamp_precision — open a fake pcap_t for compiling filters or opening a capture for output

🌸 SYNOPSIS 🌸

#include <pcap/pcap.h>

pcap_t *pcap_open_dead(int linktype, int snaplen);
pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,
    u_int precision);

💅 DESCRIPTION 💅

So pcap_open_dead() and pcap_open_dead_with_tstamp_precision() are literally for creating a pcap_t structure to use when you call other libpcap functions. It's typically used when you're just using libpcap for compiling BPF code — that's the main character. It can also be used if you're using pcap_dump_open(3), pcap_dump(3), and pcap_dump_close(3) to write a savefile when there's no pcap_t that supplies the packets to be written. Iconic. 🎀

• linktype — specifies the link-layer type for the pcap_t.
• snaplen — specifies the snapshot length for the pcap_t.

When you use pcap_open_dead_with_tstamp_precision() to create a pcap_t for use with pcap_dump_open(), precision specifies the time stamp precision for packets. PCAP_TSTAMP_PRECISION_MICRO should be specified if the packets to be written have time stamps in seconds and microseconds, and PCAP_TSTAMP_PRECISION_NANO should be specified if the packets to be written have time stamps in seconds and nanoseconds. Its value does not affect pcap_compile(3). Periodt. 💅

🕰️ BACKWARD COMPATIBILITY 🕰️

pcap_open_dead_with_tstamp_precision() became available in libpcap release 1.5.1. In previous releases, there was no mechanism to open a savefile for writing with time stamps given in seconds and nanoseconds. so if you're time-traveling to old libpcap, bestie, that's the vibe check. 😭

👀 SEE ALSO 👀

• pcap(3)
• pcap-linktype(7)

mwah 💋 this little page is dated 3 January 2014 and it's the PCAP_OPEN_DEAD(3) manual page — Library Functions Manual girlie forever, no cap. 🦋