[ Previous | Next | Table of Contents | Index | Library Home | Legal | Search ]

Technical Reference: Base Operating System and Extensions, Volume 1

pcap_open_live Subroutine


Opens a network device for packet capture.


pcap Library (libpcap.a)


#include <pcap.h>

pcap_t *pcap_open_live(char * device, int snaplen,
promisc, int to_ms, char * ebuf);


The pcap_open_live subroutine opens the specified network device for packet capture. The term "live" is to indicate that a network device is being opened, as opposed to a file that contains packet capture data. This subroutine must be called before any packet capturing can occur. All other routines dealing with packet capture require the packet capture descriptor that is created and initialized with this routine. See the pcap_open_offline (pcap_open_offline Subroutine) subroutine for more details on opening a previously saved file that contains packet capture data.


device Specifies a string that contains the name of the network device to open for packet capture, for example, en0.
ebuf Returns error text and is only set when the pcap_open_live subroutine fails.
promisc Specifies that the device is to be put into promiscuous mode. A value of 1 (True) turns promiscuous mode on. If this parameter is 0 (False), the device will remain unchanged. In this case, if it has already been set to promiscuous mode (for some other reason), it will remain in this mode.
snaplen Specifies the maximum number of bytes to capture per packet.
to_ms Specifies the read timeout in milliseconds.

Return Values

Upon successful completion, the pcap_open_live subroutine will return a pointer to the packet capture descriptor that was created. If the pcap_open_live subroutine is unsuccessful, Null is returned, and text indicating the specific error is written into the ebuf buffer.

Related Information

The pcap_close (pcap_close Subroutine) subroutine, pcap_compile (pcap_compile Subroutine) subroutine, pcap_datalink (pcap_datalink Subroutine) subroutine, pcap_dispatch (pcap_dispatch Subroutine) subroutine, pcap_dump (pcap_dump Subroutine) subroutine, pcap_dump_open (pcap_dump_open Subroutine) subroutine, pcap_geterr (pcap_geterr Subroutine) subroutine, pcap_loop (pcap_loop Subroutine) subroutine, pcap_open_offline (pcap_open_offline Subroutine) subroutine, pcap_perror (pcap_perror Subroutine) subroutine, pcap_setfilter (pcap_setfilter Subroutine) subroutine, pcap_snapshot (pcap_setfilter Subroutine) subroutine, pcap_stats (pcap_stats Subroutine) subroutine.

[ Previous | Next | Table of Contents | Index | Library Home | Legal | Search ]