PCAP_SET_PROTOCOL_LINUX(3PCAP)

💖 PCAP_SET_PROTOCOL_LINUX 💖

okay bestie, welcome to the 3PCAP section of the manual, this is pcap_set_protocol_linux and it's literally the most niche little Linux-only baddie you'll ever meet 🐧✨

✨ NAME ✨

pcap_set_protocol_linux — set the capture protocol for a capture handle that hasn't been activated yet 👑

🌸 SYNOPSIS 🌸

#include <pcap/pcap.h>

int pcap_set_protocol_linux(pcap_t *p, int protocol);

🦋 DESCRIPTION 🦋

so here's the tea ☕ On network interface devices on Linux, pcap_set_protocol_linux() sets the protocol that's gonna be used in the socket(2) call when your capture socket gets created at activation time. The argument is a link-layer protocol value — like the values chillin' in the <linux/if_ether.h> header file — and you gotta specify it in host byte order, no cap.

If protocol is non-zero, then packets of that protocol get captured when the handle is activated. Otherwise? all the packets get captured, every single one, she's not picky 💅

This function is only provided on Linux, and if you use it on any device that isn't a network interface, it's just gonna have no effect — it'll sit there looking pretty for nothing 🙈

⚠️ It should not be used in portable code. Like, at all. Instead, specify a filter with pcap_setfilter(3PCAP). That's the move, bestie.

okay now here's the deep lore, pay attention 📚 If a given network interface provides a standard link-layer header, with a standard packet type, but provides some packet types with a different socket-layer protocol type from the one in the link-layer header, then that packet type cannot be filtered with a filter specified with pcap_setfilter(). BUT ✨ it can be filtered by specifying the socket-layer protocol type using pcap_set_protocol_linux(). iconic behaviour honestly.

💫 RETURN VALUE 💫

• pcap_set_protocol_linux() returns 0 on success 🎉
• or PCAP_ERROR_ACTIVATED if you called it on a capture handle that's already been activated 😭 like girl she's awake, too late

🌈 BACKWARD COMPATIBILITY 🌈

This function became available in libpcap release 1.9.0 — so if you're on something older, she simply does not exist, sorry babe 💀

👑 SEE ALSO 👑

• pcap(3PCAP)
• pcap_create(3PCAP)
• pcap_activate(3PCAP)

mwah 💋 that's the whole page, written back on 22 August 2018 and filed under PCAP_SET_PROTOCOL_LINUX in the 3PCAP manual, from the libpcap girlies 🫶 go forth and capture responsibly, ily ✨