pcap_open_offline(3) - NetBSD Manual Pages

PCAP_OPEN_OFFLINE(3)                                      PCAP_OPEN_OFFLINE(3)




NAME

       pcap_open_offline,             pcap_open_offline_with_tstamp_precision,
       pcap_fopen_offline, pcap_fopen_offline_with_tstamp_precision -  open  a
       saved capture file for reading


SYNOPSIS

       #include <pcap/pcap.h>

       char errbuf[PCAP_ERRBUF_SIZE];

       pcap_t *pcap_open_offline(const char *fname, char *errbuf);
       pcap_t *pcap_open_offline_with_tstamp_precision(const char *fname,
           u_int precision, char *errbuf);
       pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf);
       pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *fp,
           u_int precision, char *errbuf);


DESCRIPTION

       pcap_open_offline()  and  pcap_open_offline_with_tstamp_precision() are
       called to open a ``savefile'' for reading.

       fname specifies the name of the file to open. The  file  can  have  the
       pcap  file  format  as described in pcap-savefile(5), which is the file
       format used by, among other programs, tcpdump(8)  and  tcpslice(1),  or
       can  have  the pcapng file format, although not all pcapng files can be
       read.  The name "-" is a synonym for stdin.

       pcap_open_offline_with_tstamp_precision() takes an additional precision
       argument    specifying   the   time   stamp   precision   desired;   if
       PCAP_TSTAMP_PRECISION_MICRO is specified, packet time  stamps  will  be
       supplied in seconds and microseconds, and if PCAP_TSTAMP_PRECISION_NANO
       is specified, packet time  stamps  will  be  supplied  in  seconds  and
       nanoseconds.   If the time stamps in the file do not have the same pre-
       cision as the requested precision, they will be scaled up  or  down  as
       necessary before being supplied.

       Alternatively,     you     may     call     pcap_fopen_offline()     or
       pcap_fopen_offline_with_tstamp_precision() to read dumped data from  an
       existing  open  stream  fp.  pcap_fopen_offline_with_tstamp_precision()
       takes an additional precision argument as described above.   Note  that
       on Windows, that stream should be opened in binary mode.


RETURN VALUE

       pcap_open_offline(),         pcap_open_offline_with_tstamp_precision(),
       pcap_fopen_offline(),  and   pcap_fopen_offline_with_tstamp_precision()
       return a pcap_t * on success and NULL on failure.  If NULL is returned,
       errbuf is filled in with  an  appropriate  error  message.   errbuf  is
       assumed to be able to hold at least PCAP_ERRBUF_SIZE chars.


BACKWARD COMPATIBILITY

       pcap_open_offline_with_tstamp_precision                             and
       pcap_fopen_offline_with_tstamp_precision became  available  in  libpcap
       release  1.5.1.   In previous releases, time stamps from a savefile are
       always given in seconds and microseconds.


SEE ALSO

       pcap(3), pcap-savefile(5)



                                8 January 2018            PCAP_OPEN_OFFLINE(3)