Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
PCAP_OPEN_OFFLINE(3)	   Library Functions Manual	  PCAP_OPEN_OFFLINE(3)

       pcap_open_offline,	      pcap_open_offline_with_tstamp_precision,
       pcap_fopen_offline, pcap_fopen_offline_with_tstamp_precision -  open  a
       saved capture file for reading

       #include	<pcap/pcap.h>

       char errbuf[PCAP_ERRBUF_SIZE];

       pcap_t *pcap_open_offline(const char *fname, char *errbuf);
       pcap_t *pcap_open_offline_with_tstamp_precision(const char *fname,
	   u_int precision, char *errbuf);
       pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf);
       pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *fp,
	   u_int precision, char *errbuf);

       pcap_open_offline()  and	 pcap_open_offline_with_tstamp_precision() are
       called to open a	``savefile'' for reading.

       fname specifies the name	of the file to open. The  file	can  have  the
       pcap  file  format  as  described in pcap-savefile(@MAN_FILE_FORMATS@),
       which is	the file format	used by, among other programs, tcpdump(1)  and
       tcpslice(1),  or	 can  have  the	 pcapng	 file format, although not all
       pcapng files can	be read.  The name "-" is a synonym for	stdin.

       pcap_open_offline_with_tstamp_precision() takes an additional precision
       argument	   specifying	the   time   stamp   precision	 desired;   if
       PCAP_TSTAMP_PRECISION_MICRO is specified, packet	time  stamps  will  be
       supplied	in seconds and microseconds, and if PCAP_TSTAMP_PRECISION_NANO
       is specified, packet time  stamps  will	be  supplied  in  seconds  and
       nanoseconds.   If the time stamps in the	file do	not have the same pre-
       cision as the requested precision, they will be scaled up  or  down  as
       necessary before	being supplied.

       Alternatively,  you  may	 call  pcap_fopen_offline() or pcap_fopen_off-
       line_with_tstamp_precision() to read dumped data	from an	existing  open
       stream  fp.   pcap_fopen_offline_with_tstamp_precision()	takes an addi-
       tional precision	argument as described above.  Note  that  on  Windows,
       that stream should be opened in binary mode.

       pcap_open_offline(),	    pcap_open_offline_with_tstamp_precision(),
       pcap_fopen_offline(),  and   pcap_fopen_offline_with_tstamp_precision()
       return a	pcap_t * on success and	NULL on	failure.  If NULL is returned,
       errbuf is filled	in with	an appropriate error message.  errbuf  is  as-
       sumed to	be able	to hold	at least PCAP_ERRBUF_SIZE chars.

       pcap(3),	pcap-savefile(@MAN_FILE_FORMATS@)

				3 January 2014		  PCAP_OPEN_OFFLINE(3)


Want to link to this manual page? Use this URL:

home | help