Movatterモバイル変換

pcap_open_dead(3pcap) — Linux manual page

PCAP_OPEN_DEAD(3PCAP)PCAP_OPEN_DEAD(3PCAP)

NAME        top

       pcap_open_dead, pcap_open_dead_with_tstamp_precision - open a fake       pcap_t for compiling filters or opening a capture for output

SYNOPSIS        top

#include <pcap/pcap.h>pcap_t *pcap_open_dead(int linktype, int snaplen);pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,u_int precision);

DESCRIPTION        top

pcap_open_dead() andpcap_open_dead_with_tstamp_precision() are       used for creating apcap_tstructure to use when calling the other       functions in libpcap.  It is typically used when just using       libpcap for compiling BPF code; it can also be used if usingpcap_dump_open(3PCAP),pcap_dump(3PCAP), andpcap_dump_close(3PCAP) to write a savefile if there is nopcap_t       that supplies the packets to be written.linktype specifies the link-layer type for thepcap_t.snaplen specifies the snapshot length for thepcap_t.       Whenpcap_open_dead_with_tstamp_precision(), is used to create apcap_tfor use withpcap_dump_open(),precision specifies the time       stamp precision for packets;PCAP_TSTAMP_PRECISION_MICROshould be       specified if the packets to be written have time stamps in seconds       and microseconds, andPCAP_TSTAMP_PRECISION_NANOshould be       specified if the packets to be written have time stamps in seconds       and nanoseconds.  Its value does not affectpcap_compile(3PCAP).

BACKWARD COMPATIBILITY        top

       Thepcap_open_dead_with_tstamp_precision() function became       available in libpcap release 1.5.1.  In previous releases, there       was no mechanism to open a savefile for writing with time stamps       given in seconds and nanoseconds.

SEE ALSO        top

pcap(3PCAP),pcap-linktype(7)

COLOPHON        top

       This page is part of thelibpcap (packet capture library) project.       Information about the project can be found at        ⟨http://www.tcpdump.org/⟩.  If you have a bug report for this       manual page, see ⟨http://www.tcpdump.org/#patches⟩.  This page was       obtained from the project's upstream Git repository       ⟨https://github.com/the-tcpdump-group/libpcap.git⟩ on 2025-08-11.       (At that time, the date of the most recent commit that was found       in the repository was 2025-08-10.)  If you discover any rendering       problems in this HTML version of the page, or you believe there is       a better or more up-to-date source for the page, or you have       corrections or improvements to the information in this COLOPHON       (which isnot part of the original manual page), send a mail to       man-pages@man7.org                              3 January 2014PCAP_OPEN_DEAD(3PCAP)

HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH.