pcap_datalink(3PCAP) man page
This man page documents libpcap version 1.11.0-PRE-GIT (see also: 1.10.4, 1.10.2, 1.10.1, 1.10.0, 1.9.1, 1.8.1, 1.7.4, 1.6.2, 1.5.3).
Your system may have a different version installed, possibly with some local modifications. To achieve the best results, please make sure this version of this man page suits your needs. If necessary, try to look for a different version on this web site or in the man pages available in your installation.NAME
SYNOPSIS
#include <pcap/pcap.h> int pcap_datalink(pcap_t *p);
DESCRIPTION
It must not be called on a pcap descriptor created by pcap_create(3PCAP) that has not yet been activated by pcap_activate(3PCAP).
https://www.tcpdump.org/linktypes.html lists the values pcap_datalink() can return and describes the packet formats that correspond to those values.
Do
NOT
assume that the packets for a given capture or ``savefile`` will have
any given link-layer header type, such as
DLT_EN10MB
for Ethernet. For example, the "any" device on Linux will have a
link-layer header type of
DLT_LINUX_SLL
or
DLT_LINUX_SLL2
even if all devices on the system at the time the "any" device is opened
have some other data link type, such as
DLT_EN10MB
for Ethernet.
RETURN VALUE
PCAP_ERROR_NOT_ACTIVATED
if called on a capture handle that has been created but not activated.