PCAP_OPEN_OFFLINE(3) PCAP_OPEN_OFFLINE(3)
NAME
pcap_open_offline, pcap_open_offline_with_tstamp_precision, pcap_fopen_offline, pcap_fopen_offline_with_tstamp_precision - open a saved capture file for reading
SYNOPSIS
#include <pcap/pcap.h> char errbuf[PCAP_ERRBUF_SIZE]; pcap_t *pcap_open_offline(const char *fname, char *errbuf); pcap_t *pcap_open_offline_with_tstamp_precision(const char *fname, u_int precision, char *errbuf); pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf); pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *fp, u_int precision, char *errbuf);
DESCRIPTION
pcap_open_offline() and pcap_open_offline_with_tstamp_precision() are called to open a ``savefile'' for reading. fname specifies the name of the file to open. The file can have the pcap file format as described in pcap-savefile(5), which is the file format used by, among other programs, tcpdump(8) and tcpslice(1), or can have the pcapng file format, although not all pcapng files can be read. The name "-" is a synonym for stdin. pcap_open_offline_with_tstamp_precision() takes an additional precision argument specifying the time stamp precision desired; if PCAP_TSTAMP_PRECISION_MICRO is specified, packet time stamps will be supplied in seconds and microseconds, and if PCAP_TSTAMP_PRECISION_NANO is specified, packet time stamps will be supplied in seconds and nanoseconds. If the time stamps in the file do not have the same pre- cision as the requested precision, they will be scaled up or down as necessary before being supplied. Alternatively, you may call pcap_fopen_offline() or pcap_fopen_offline_with_tstamp_precision() to read dumped data from an existing open stream fp. pcap_fopen_offline_with_tstamp_precision() takes an additional precision argument as described above. Note that on Windows, that stream should be opened in binary mode.
RETURN VALUE
pcap_open_offline(), pcap_open_offline_with_tstamp_precision(), pcap_fopen_offline(), and pcap_fopen_offline_with_tstamp_precision() return a pcap_t * on success and NULL on failure. If NULL is returned, errbuf is filled in with an appropriate error message. errbuf is assumed to be able to hold at least PCAP_ERRBUF_SIZE chars.
BACKWARD COMPATIBILITY
pcap_open_offline_with_tstamp_precision() and pcap_fopen_offline_with_tstamp_precision() became available in libpcap release 1.5.1. In previous releases, time stamps from a savefile are always given in seconds and microseconds.
SEE ALSO
pcap(3), pcap-savefile(5) 23 August 2018 PCAP_OPEN_OFFLINE(3)
Powered by man-cgi (2024-08-26). Maintained for NetBSD by Kimmo Suominen. Based on man-cgi by Panagiotis Christias.