pcap_open_dead(3PCAP) man page
This man page documents libpcap version 1.10.4 (see also: git master branch, 1.10.2, 1.10.1, 1.10.0, 1.9.1, 1.8.1, 1.7.4, 1.6.2, 1.5.3).
Your system may have a different version installed, possibly with some local modifications. To achieve the best results, please make sure this version of this man page suits your needs. If necessary, try to look for a different version on this web site or in the man pages available in your installation.NAME
SYNOPSIS
#include <pcap/pcap.h> pcap_t *pcap_open_dead(int linktype, int snaplen); pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen, u_int precision);
DESCRIPTION
pcap_open_dead()
and
pcap_open_dead_with_tstamp_precision()
are used for creating a
pcap_t
structure to use when calling the other functions in libpcap. It is
typically used when just using libpcap for compiling BPF code; it can
also be used if using
pcap_dump_open(3PCAP),
pcap_dump(3PCAP),
and
pcap_dump_close(3PCAP)
to write a savefile if there is no
pcap_t
that supplies the packets to be written.
linktype
specifies the link-layer type for the
pcap_t
.
snaplen
specifies the snapshot length for the
pcap_t
.
When
pcap_open_dead_with_tstamp_precision(),
is used to create a
pcap_t
for use with
pcap_dump_open(),
precision
specifies the time stamp precision for packets;
PCAP_TSTAMP_PRECISION_MICRO
should be specified if the packets to be written have time stamps in
seconds and microseconds, and
PCAP_TSTAMP_PRECISION_NANO
should be specified if the packets to be written have time stamps in
seconds and nanoseconds. Its value does not affect
pcap_compile(3PCAP).