[ Bottom of Page | Previous Page | Next Page | Contents | Index | Library Home | Legal | Search ]

Technical Reference: Base Operating System and Extensions, Volume 1

pcap_open_offline Subroutine


Opens a previously saved file containing packet capture data.


pcap Library (libpcap.a)


#include <pcap.h>

pcap_t *pcap_open_offline(char * fname, char * ebuf);


The pcap_open_offline subroutine opens a previously saved packet capture data file, known as the savefile. This subroutine creates and initializes a packet capture (pcap) descriptor and opens the specified savefile containing the packet capture data for reading.

This subroutine should be called before any other related routines that require a packet capture descriptor for offline packet processing. See the pcap_open_live (pcap_open_live Subroutine) subroutine for more details on live packet capture.

The format of the savefile is expected to be the same as the format used by the tcpdump command.


ebuf Returns error text and is only set when the pcap_open_offline subroutine fails.
fname Specifies the name of the file to open. A hyphen (-) passed as the fname parameter indicates that stdin should be used as the file to open.

Return Values

Upon successful completion, the pcap_open_offline subroutine will return a pointer to the newly created packet capture descriptor. If the pcap_open_offline subroutine is unsuccessful, Null is returned, and text indicating the specific error is written into the ebuf buffer.

Related Information

The pcap_close (pcap_close Subroutine) subroutine, pcap_dispatch (pcap_dispatch Subroutine) subroutine, pcap_file (pcap_file Subroutine) subroutine, pcap_fileno (pcap_fileno Subroutine) subroutine, pcap_geterr (pcap_geterr Subroutine) subroutine, pcap_is_swapped (pcap_is_swapped Subroutine) subroutine, pcap_loop (pcap_loop Subroutine) subroutine, pcap_major_version (pcap_major_version Subroutine) subroutine, pcap_minor_version (pcap_minor_version Subroutine) subroutine, pcap_next (pcap_next Subroutine) subroutine, pcap_open_live (pcap_open_live Subroutine) subroutine.

The tcpdump command.

[ Top of Page | Previous Page | Next Page | Contents | Index | Library Home | Legal | Search ]