pcap_open_dead (3)
Leading comments
Copyright (c) 1994, 1996, 1997 The Regents of the University of California. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that: (1) source code distributions retain the above copyright notice and this paragraph in its entirety, (2) distributions including binary code include the above copyright notice and this paragraph in its entirety in the documentation or other materials provided with the distribution...
NAME
pcap_open_dead, pcap_open_dead_with_tstamp_precision - open a fake pcap_t for compiling filters or opening a capture for outputSYNOPSIS
#include <pcap/pcap.h>
pcap_t *pcap_open_dead(int linktype, int snaplen);
pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,
u_int precision);
DESCRIPTION
pcap_open_dead() and pcap_open_dead_with_tstamp_precision() are used for creating a pcap_t structure to use when calling the other functions in libpcap. It is typically used when just using libpcap for compiling BPF code; it can also be used if using pcap_dump_open(), pcap_dump(), and pcap_dump_close() to write a savefile if there is no pcap_t that supplies the packets to be written.
linktype specifies the link-layer type for the pcap_t.
snaplen specifies the snapshot length for the pcap_t.
When pcap_open_dead_with_tstamp_precision(), is used to create a pcap_t for use with pcap_dump_open(), precision specifies the time stamp precision for packets; PCAP_TSTAMP_PRECISION_MICRO should be specified if the packets to be written have time stamps in seconds and microseconds, and PCAP_TSTAMP_PRECISION_NANO should be specified if the packets to be written have time stamps in seconds and nanoseconds. Its value does not affect pcap_compile().