PCAP_FINDALLDEVS(3PCAP)

💖 PCAP_FINDALLDEVS(3PCAP) — bestie's guide to listing capture devices 💖

okay so this is a page from the 3PCAP manual family, and it's literally about finding every network device you could possibly sniff on. sit down, grab a strawberry drink 🍓, we're doing this.

---

✨ NAME ✨

pcap_findalldevs, pcap_freealldevs — get a list of capture devices, and free that list. that's it, that's the whole vibe. one function gives you the list, the other one cleans it up so you don't leak. iconic duo behavior 💅

---

🌸 SYNOPSIS 🌸

#include <pcap/pcap.h>

char errbuf[PCAP_ERRBUF_SIZE];

int pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf);
void pcap_freealldevs(pcap_if_t *alldevs);

---

🦋 DESCRIPTION 🦋

pcap_findalldevs() constructs a list of network devices that can be opened with pcap_create(3PCAP) and pcap_activate(3PCAP) or with pcap_open_live(3PCAP). cute, right? ✨

⚠️ but lowkey important: there may be network devices that cannot be opened by the process calling pcap_findalldevs(), because, for example, that process does not have sufficient privileges to open them for capturing — and if so, those devices will not appear on the list. so no, the list is not the whole truth, it's the whole truth for you specifically. 🙈

alldevsp is a pointer to a pcap_if_t *; errbuf is a buffer large enough to hold at least PCAP_ERRBUF_SIZE chars. don't skimp on the buffer, she needs room to spill the tea about errors 💀

If pcap_findalldevs() succeeds, the pointer pointed to by alldevsp is set to point to the first element of the list, or to NULL if no devices were found (this is considered success). yes bestie, zero devices = still slaying, still return code 0 ✨

Each element of the list is of type pcap_if_t, and has the following members:

• next — if not NULL, a pointer to the next element in the list; NULL for the last element of the list
• name — a pointer to a string giving a name for the device to pass to pcap_open_live()
• description — if not NULL, a pointer to a string giving a human-readable description of the device. yes, the little nickname. adorable 🎀
• addresses — a pointer to the first element of a list of network addresses for the device, or NULL if the device has no addresses
• flags — device flags, and here's the whole lineup:
  • PCAP_IF_LOOPBACK — set if the device is a loopback interface (you talking to yourself, main character energy)
  • PCAP_IF_UP — set if the device is up
  • PCAP_IF_RUNNING — set if the device is running
  • PCAP_IF_WIRELESS — set if the device is a wireless interface; this includes IrDA as well as radio-based networks such as IEEE 802.15.4 and IEEE 802.11, so it doesn't just mean Wi-Fi. like, it's giving "wireless in the broadest sense" 💫
  • PCAP_IF_CONNECTION_STATUS — a bitmask for an indication of whether the adapter is connected or not; for wireless interfaces, "connected" means "associated with a network"

The possible values for the connection status bits are:

• PCAP_IF_CONNECTION_STATUS_UNKNOWN — it's unknown whether the adapter is connected or not (the it's-complicated era 😭)
• PCAP_IF_CONNECTION_STATUS_CONNECTED — the adapter is connected
• PCAP_IF_CONNECTION_STATUS_DISCONNECTED — the adapter is disconnected
• PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE — the notion of "connected" and "disconnected" don't apply to this interface; for example, it doesn't apply to a loopback device. like, girl, that concept was never about you 🫶

---

🌈 the address list, one level deeper 🌈

Each element of the list of addresses is of type pcap_addr_t, and has the following members:

• next — if not NULL, a pointer to the next element in the list; NULL for the last element of the list
• addr — a pointer to a struct sockaddr containing an address
• netmask — if not NULL, a pointer to a struct sockaddr that contains the netmask corresponding to the address pointed to by addr
• broadaddr — if not NULL, a pointer to a struct sockaddr that contains the broadcast address corresponding to the address pointed to by addr; may be NULL if the device doesn't support broadcasts
• dstaddr — if not NULL, a pointer to a struct sockaddr that contains the destination address corresponding to the address pointed to by addr; may be NULL if the device isn't a point-to-point interface

💀 REAL TALK: note that the addresses in the list of addresses might be IPv4 addresses, IPv6 addresses, or some other type of addresses, so you must check the sa_family member of the struct sockaddr before interpreting the contents of the address. do not assume that the addresses are all IPv4 addresses, or even all IPv4 or IPv6 addresses. that's the classic "assumption = embarrassment" pipeline, ngl.

so: IPv4 addresses have the value AF_INET, IPv6 addresses have the value AF_INET6 (which older operating systems that don't support IPv6 might not define), and other addresses have other values. Whether other addresses are returned, and what types they might have, is platform-dependent. Namely, link-layer addresses, such as Ethernet MAC addresses, have the value AF_PACKET (on Linux) or AF_LINK (on AIX, FreeBSD, Haiku, illumos, macOS, NetBSD and OpenBSD) or are not returned at all (on GNU/Hurd and Solaris). the way that platforms can't agree on anything 😭 iykyk

For IPv4 addresses, the struct sockaddr pointer can be interpreted as if it pointed to a struct sockaddr_in; for IPv6 addresses, it can be interpreted as if it pointed to a struct sockaddr_in6. For link-layer addresses, it can be interpreted as if it pointed to a struct sockaddr_ll (for AF_PACKET) or a struct sockaddr_dl (for AF_LINK). cast responsibly bestie, she's typed 🧚

The list of devices must be freed with pcap_freealldevs(3PCAP), which frees the list pointed to by alldevs. must. no cap. if you don't, that's a memory leak and not the cute kind 🌸

---

🔥 RETURN VALUE 🔥

pcap_findalldevs() returns 0 on success and PCAP_ERROR on failure. and as indicated, finding no devices is considered success, rather than failure, so 0 will be returned in that case. zero devices, zero problems, still a W 👑

If PCAP_ERROR is returned, errbuf is filled in with an appropriate error message, and the pointer pointed to by alldevsp is set to NULL. so you get a sad NULL and a lil explanation note. at least she tells you why 💖

---

⭐ BACKWARD COMPATIBILITY ⭐

history lesson, but make it fashion:

• The PCAP_IF_UP and PCAP_IF_RUNNING constants became available in libpcap release 1.6.1.
• The PCAP_IF_WIRELESS, PCAP_IF_CONNECTION_STATUS, PCAP_IF_CONNECTION_STATUS_UNKNOWN, PCAP_IF_CONNECTION_STATUS_CONNECTED, PCAP_IF_CONNECTION_STATUS_DISCONNECTED, and PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE constants became available in libpcap release 1.9.0.

so if you're on some ancient libpcap and these aren't showing up, that's why. it's not you, it's the version 🫶

---

🎀 SEE ALSO 🎀

• pcap(3PCAP) — the mothership. start there.

---

and that's the whole page! go forth and enumerate those interfaces, bestie 💜✨

this cuteness was brought to you by the PCAP_FINDALLDEVS(3PCAP) manual page, dated 9 August 2024 — mwah, love you, bye 🎀💅