PCAP_DATALINK(3PCAP)

💅 PCAP_DATALINK — bestie's guide to the link-layer header type ✨

Okay so this is a page from the PCAP manual, section 3PCAP, and it's literally about one tiny function that answers one huge question: what kind of packets are we even looking at?? 🎀

🦋 NAME

pcap_datalink — get the link-layer header type. That's it. That's the whole vibe. 👑

✨ SYNOPSIS

#include <pcap/pcap.h>

int pcap_datalink(pcap_t *p);

🌸 DESCRIPTION

pcap_datalink() returns the link-layer header type for the live capture or the "savefile" that you specified with p. Simple queen behavior, ngl. 💖

⚠️ But listen — it must not be called on a pcap descriptor created by pcap_create(3PCAP) that has not yet been activated by pcap_activate(3PCAP). Like, do not come for her before she's ready, okay?? 😭

The link https://www.tcpdump.org/linktypes.html lists the values pcap_datalink() can return and describes the packet formats that correspond to those values. Go read it, it's giving reference material and it ate. 🔥

Do NOT assume that the packets for a given capture or "savefile" will have any given link-layer header type, such as DLT_EN10MB for Ethernet. Lowkey this is the part everyone gets wrong so pay attention bestie 🙈 — for example, the "any" device on Linux will have a link-layer header type of DLT_LINUX_SLL or DLT_LINUX_SLL2 even if all devices on the system at the time the "any" device is opened have some other data link type, such as DLT_EN10MB for Ethernet. Yeah. She's not like the other devices. 💀

🌈 RETURN VALUE

• On success, pcap_datalink() returns the link-layer header type. Slay, we love a successful return. ⭐
• If you called it on a capture handle that has been created but not activated, you get PCAP_ERROR_NOT_ACTIVATED. The audacity, honestly. 🫠

💜 SEE ALSO

• pcap(3PCAP)
• pcap-linktype(7)

That's the whole page, bestie — no notes, no cap. 🧚 This was the PCAP_DATALINK(3PCAP) page, dated 7 April 2014, and it's iconic, periodt. 💅✨