PCAP_CREATE(3PCAP)

💖 NAME 💖

okay bestie, this is the pcap_create(3PCAP) page, and it's literally about pcap_create — create a live capture handle. ✨

✨ SYNOPSIS ✨

#include <pcap/pcap.h>

char errbuf[PCAP_ERRBUF_SIZE];

pcap_t *pcap_create(const char *source, char *errbuf);

🦋 DESCRIPTION 🦋

So pcap_create() is the function you use to make a packet capture handle, aka the thing that lets you look at packets on the network. 🫶

source is a string that says which network device to open. On Linux systems with 2.2 or later kernels, you can pass "any" or NULL as the source argument to capture packets from all interfaces. Iconic. 👑

errbuf is a buffer big enough to hold at least PCAP_ERRBUF_SIZE chars. No cap. 💅

The handle you get back must be activated with pcap_activate(3PCAP) before you can capture packets with it. You can set capture options on the handle before activating it, like promiscuous mode — yes, before. Main character energy. 🔥

🌈 RETURN VALUE 🌈

pcap_create() returns a pcap_t * on success and NULL on failure. If it returns NULL, errbuf gets filled in with an appropriate error message. Periodt. 💖

👀 SEE ALSO 👀

• pcap(3PCAP)

mwah 💋 that's the whole page — from the PCAP_CREATE(3PCAP) source/version tag, dated 30 November 2023. 🎀