PCAP_OFFLINE_FILTER(3PCAP)

💅 PCAP_OFFLINE_FILTER 💅

ok so bestie, welcome to PCAP_OFFLINE_FILTER(3PCAP) — the libpcap page that's literally just "does this filter match this packet, yes or no" and honestly? iconic. no capture needed, no network interface, just vibes and bytes. 🦋

---

✨ SYNOPSIS ✨

#include <pcap/pcap.h>

int pcap_offline_filter(const struct bpf_program *fp,
    const struct pcap_pkthdr *h, const u_char *pkt);

that's it. three args. one int back. slay. 🎀

---

🌸 DESCRIPTION 🌸

so pcap_offline_filter() does exactly the thing its name says: it checks whether a filter matches a packet. no cap. 🔥

here's the cast of characters:

• fp — a pointer to a bpf_program struct, usually the glow-up result of calling pcap_compile(3PCAP) 🧚
• h — points to the pcap_pkthdr structure for the packet (the metadata bestie)
• pkt — points to the data in the packet, the actual payload main character 💖

now, inside the bpf_program struct, the bf_insns member is either NULL — which means reject all packets, like a bouncer at the club 💀 — or it points to an array of one or more struct bpf_insn elements. and if it's the array case? then the bf_len member must be set to the number of elements. that's literally what pcap_compile() produces for you, so you're chilling. ✨

⚠️ two things you gotta respect or it's giving undefined behaviour energy: - the filter program must have been compiled for a link-layer header type that matches the packet data — mismatched link-layer types = nonsense results, periodt. - on Linux, the filter must not use BPF extensions. peep pcap_compile() for more info on that one. 🐧

---

👑 RETURN VALUE 👑

pcap_offline_filter() returns the return value of the filter program. that's it, that's the whole rule. 😌

• zero → the packet doesn't match the filter 😭
• non-zero → the packet matches the filter 🎉

---

🦋 BACKWARD COMPATIBILITY 🦋

big yikes moment in history: in libpcap releases before 1.10.7, this function ignored the provided bf_len value. so if you're on some ancient build, that detail mattered. we don't talk about it. 💀

---

🌈 SEE ALSO 🌈

• pcap(3PCAP) — the whole family, go say hi 🫶

---

and that's the page, bestie! this one came to you courtesy of the libpcap source and is dated 12 March 2026 — go forth and filter responsibly, mwah 💜🍓