pcap_open_offline Subroutine

Purpose

Opens a previously saved file containing packet capture data.

Library

pcap Library (libpcap.a)

Syntax

#include <pcap.h> pcap_t *pcap_open_offline(char * fname, char * ebuf);

Description

The pcap_open_offline subroutine opens a previously saved packet capture data file, known as the savefile. This subroutine creates and initializes a packet capture (pcap) descriptor and opens the specified savefile containing the packet capture data for reading.

This subroutine should be called before any other related routines that require a packet capture descriptor for offline packet processing. See the pcap_open_live (pcap_open_live Subroutine) subroutine for more details on live packet capture.

Note: The format of the savefile is expected to be the same as the format used by the tcpdump command.

Parameters

Item	Description
ebuf	Returns error text and is only set when the pcap_open_offline subroutine fails.
fname	Specifies the name of the file to open. A hyphen (-) passed as the fname parameter indicates that stdin should be used as the file to open.

Return Values

Upon successful completion, the pcap_open_offline subroutine will return a pointer to the newly created packet capture descriptor. If the pcap_open_offline subroutine is unsuccessful, Null is returned, and text indicating the specific error is written into the ebuf buffer.