[ Previous | Next | Table of Contents | Index | Library Home | Legal | Search ]

Technical Reference: Base Operating System and Extensions, Volume 1

pcap_open_offline Subroutine


Opens a previously saved file containing packet capture data.


pcap Library (libpcap.a)


#include <pcap.h>

pcap_t *pcap_open_offline(char * fname, char * ebuf);


The pcap_open_offline subroutine opens a previously saved packet capture data file, known as the savefile. This subroutine creates and initializes a packet capture (pcap) descriptor and opens the specified savefile containing the packet capture data for reading.

This subroutine should be called before any other related routines that require a packet capture descriptor for offline packet processing. See the pcap_open_live (pcap_open_live Subroutine) subroutine for more details on live packet capture.

Note: The format of the savefile is expected to be the same as the format used by the tcpdump command.


ebuf Returns error text and is only set when the pcap_open_offline subroutine fails.
fname Specifies the name of the file to open. A hyphen (-) passed as the fname parameter indicates that stdin should be used as the file to open.

Return Values

Upon successful completion, the pcap_open_offline subroutine will return a pointer to the newly created packet capture descriptor. If the pcap_open_offline subroutine is unsuccessful, Null is returned, and text indicating the specific error is written into the ebuf buffer.

Related Information

The pcap_close (pcap_close Subroutine) subroutine, pcap_dispatch (pcap_dispatch Subroutine) subroutine, pcap_file (pcap_file Subroutine) subroutine, pcap_fileno (pcap_fileno Subroutine) subroutine, pcap_geterr (pcap_geterr Subroutine) subroutine, pcap_is_swapped (pcap_is_swapped Subroutine) subroutine, pcap_loop (pcap_loop Subroutine) subroutine, pcap_major_version (pcap_major_version Subroutine) subroutine, pcap_minor_version (pcap_minor_version Subroutine) subroutine, pcap_next (pcap_next Subroutine) subroutine, pcap_open_live (pcap_open_live Subroutine) subroutine.

The tcpdump command.

[ Previous | Next | Table of Contents | Index | Library Home | Legal | Search ]