PCAP_SETFILTER(3PCAP)

💅 PCAP_SETFILTER 💅

okay so bestie, welcome to the PCAP_SETFILTER era — this one’s from the 3PCAP manual, and we’re about to set a filter together 💖

🌸 NAME 🌸

pcap_setfilter — set the filter. that’s it, that’s the whole name, and she ate ✨

✨ SYNOPSIS ✨

#include <pcap/pcap.h>

int pcap_setfilter(pcap_t *p, struct bpf_program *fp);

💖 DESCRIPTION 💖

so pcap_setfilter() is literally how you specify a filter program. fp is a pointer to a bpf_program struct — usually the result of a call to pcap_compile(3PCAP) 🎀

like, that’s the whole vibe: filter program goes in, and you’re specifying it. no cap.

🔥 RETURN VALUE 🔥

pcap_setfilter() returns 0 on success. if you call it on a capture handle that has been created but not activated, it returns PCAP_ERROR_NOT_ACTIVATED — yes, that’s a whole mood 😭. on other errors, it returns PCAP_ERROR.

if PCAP_ERROR is returned, you can call pcap_geterr(3PCAP) or pcap_perror(3PCAP) with p as an argument to fetch or display the error text. very helpful, very iconic 💜

🫶 SEE ALSO 🫶

• pcap(3PCAP)

and that’s the whole page, bestie 💖 from the 3PCAP manual, dated 5 March 2022 — slay, periodt 💅✨