Opens a previously saved file containing packet capture data.
pcap Library (libpcap.a)
#include <pcap.h>
pcap_t *pcap_open_offline(char * fname, char * ebuf);
The pcap_open_offline subroutine opens a previously saved packet capture data file, known as the savefile. This subroutine creates and initializes a packet capture (pcap) descriptor and opens the specified savefile containing the packet capture data for reading.
This subroutine should be called before any other related routines that require a packet capture descriptor for offline packet processing. See the pcap_open_live (pcap_open_live Subroutine) subroutine for more details on live packet capture.
Note: The format of the savefile is expected to be the same as the format used by the tcpdump command.
Upon successful completion, the pcap_open_offline subroutine will return a pointer to the newly created packet capture descriptor. If the pcap_open_offline subroutine is unsuccessful, Null is returned, and text indicating the specific error is written into the ebuf buffer.
The pcap_close (pcap_close Subroutine) subroutine, pcap_dispatch (pcap_dispatch Subroutine) subroutine, pcap_file (pcap_file Subroutine) subroutine, pcap_fileno (pcap_fileno Subroutine) subroutine, pcap_geterr (pcap_geterr Subroutine) subroutine, pcap_is_swapped (pcap_is_swapped Subroutine) subroutine, pcap_loop (pcap_loop Subroutine) subroutine, pcap_major_version (pcap_major_version Subroutine) subroutine, pcap_minor_version (pcap_minor_version Subroutine) subroutine, pcap_next (pcap_next Subroutine) subroutine, pcap_open_live (pcap_open_live Subroutine) subroutine.
The tcpdump command.