PCAP_INJECT(3)

💖 PCAP_INJECT(3) — like, the transmit-a-packet page, bestie 💖

okay so this is a page from the Library Functions Manual and it's all about yeeting a raw packet out of your network interface. yes, we're doing that today. buckle up 🎀

---

✨ NAME ✨

pcap_inject, pcap_sendpacket — transmit a packet 🚀

---

🦋 SYNOPSIS 🦋

#include <pcap/pcap.h>

int pcap_inject(pcap_t *p, const void *buf, size_t size);
int pcap_sendpacket(pcap_t *p, const u_char *buf, int size);

---

🌸 DESCRIPTION 🌸

so pcap_inject() literally just sends a raw packet through the network interface. buf points at the data of the packet — and yes, that includes the link-layer header, don't skip it — and size is how many bytes are in the packet. no cap. 💅

⚠️ okay but listen, this is the part where you have to pay attention:

even if you successfully open the network interface, you might not have permission to send packets on it, or it might just not support sending packets at all. and here's the annoying bit — pcap_open_live(3) doesn't have a flag telling it whether to open for capturing, for sending, or for capturing and sending. so you literally cannot request an open that supports sending and then get notified at open time whether sending will even be possible. 😭 it's giving "you'll find out when you try". also, some devices might not support sending packets. full stop.

another thing — on some platforms, the link-layer header of the packet that actually gets sent might not be the same as the link-layer header of the packet you handed to pcap_inject(). why? because the source link-layer address (if the header even contains such an address) might get changed to the address assigned to the interface the packet is sent on — but only if the platform doesn't support sending completely raw and unchanged packets. 💀

and it gets worse: some drivers on some platforms might change the link-layer type field to whatever value libpcap used when attaching to the device. yes, even on platforms that nominally support sending completely raw and unchanged packets. iconic behaviour, honestly. 🙈

pcap_sendpacket() is like pcap_inject(), except it returns 0 on success instead of returning the number of bytes written. so chill of it. (for the lore: pcap_inject() comes from OpenBSD, and pcap_sendpacket() comes from WinPcap/Npcap. both are provided for compatibility.) 🫶

---

🔥 RETURN VALUE 🔥

• pcap_inject() returns the number of bytes written on success, PCAP_ERROR_NOT_ACTIVATED if you called it on a capture handle that has been created but not activated, and PCAP_ERROR on other errors. ⭐
• pcap_sendpacket() returns 0 on success, PCAP_ERROR_NOT_ACTIVATED if you called it on a capture handle that has been created but not activated, and PCAP_ERROR on other errors. 💜

if PCAP_ERROR gets returned, you can call pcap_geterr(3) or pcap_perror(3) with p as an argument to fetch or display the error text. always read the error text, bestie, it's literally telling you what went wrong 🍓

---

👑 SEE ALSO 👑

• pcap(3)

---

🌈 that's the whole page!! mwah 💋 — this one's from the Library Functions Manual, dated 5 March 2022, page PCAP_INJECT(3). go send some packets (responsibly). 🧚💖