PCAP_OPEN_DEAD(3PCAP)

💖 PCAP_OPEN_DEAD 💖

okay bestie, welcome to PCAP_OPEN_DEAD(3PCAP) — yes the name sounds dramatic but it's literally just "open a fake pcap_t for compiling filters or opening a capture for output" and honestly? iconic. 💅

✨ NAME ✨

pcap_open_dead, pcap_open_dead_with_tstamp_precision — open a fake pcap_t for compiling filters or opening a capture for output

🌸 SYNOPSIS 🌸

#include <pcap/pcap.h>

pcap_t *pcap_open_dead(int linktype, int snaplen);
pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,
    u_int precision);

🦋 DESCRIPTION 🦋

so the tea is: pcap_open_dead() and pcap_open_dead_with_tstamp_precision() are how you create a pcap_t structure to use when you're calling the other functions in libpcap. it's typically used when you're just using libpcap for compiling BPF code — that's its whole main character moment. it can also be used if you're using pcap_dump_open(3PCAP), pcap_dump(3PCAP), and pcap_dump_close(3PCAP) to write a savefile, for when there's no pcap_t that supplies the packets to be written. like, nobody's feeding you packets, so you bring your own pretend one 🫶

linktype specifies the link-layer type for the pcap_t.

snaplen specifies the snapshot length for the pcap_t.

now when pcap_open_dead_with_tstamp_precision() is used to create a pcap_t for use with pcap_dump_open(), precision specifies the time stamp precision for packets. so:

• PCAP_TSTAMP_PRECISION_MICRO — specify this if the packets to be written have time stamps in seconds and microseconds
• PCAP_TSTAMP_PRECISION_NANO — specify this if the packets to be written have time stamps in seconds and nanoseconds

⚠️ heads up bestie: its value does not affect pcap_compile(3PCAP). like, at all. don't come for me, that's just the lore.

💀 BACKWARD COMPATIBILITY 💀

the pcap_open_dead_with_tstamp_precision() function became available in libpcap release 1.5.1. in previous releases, there was literally no mechanism to open a savefile for writing with time stamps given in seconds and nanoseconds. not me crying for the pre-1.5.1 girlies 😭

🌈 SEE ALSO 🌈

• pcap(3PCAP)
• pcap-linktype(7)

and that's the whole vibe, bestie. this page is dated 3 January 2014 and it comes to you straight from the libpcap world — go forth and open your fake pcap_ts, you absolute legend 👑✨💜