PCAP_OPEN_DEAD(3)      FreeBSD Library Functions Manual      PCAP_OPEN_DEAD(3)

NAME

     pcap_open_dead, pcap_open_dead_with_tstamp_precision - open a fake pcap_t
     for compiling filters or opening a capture for output

SYNOPSIS

     #include <pcap/pcap.h>

     pcap_t *pcap_open_dead(int linktype, int snaplen);
     pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen,
         u_int precision);

DESCRIPTION

     pcap_open_dead() and pcap_open_dead_with_tstamp_precision() are used for
     creating a pcap_t structure to use when calling the other functions in
     libpcap.  It is typically used when just using libpcap for compiling BPF
     code; it can also be used if using pcap_dump_open(3), pcap_dump(3), and
     pcap_dump_close(3) to write a savefile if there is no pcap_t that
     supplies the packets to be written.

     linktype specifies the link-layer type for the pcap_t.

     snaplen specifies the snapshot length for the pcap_t.

     When pcap_open_dead_with_tstamp_precision(), is used to create a pcap_t
     for use with pcap_dump_open(), precision specifies the time stamp
     precision for packets; PCAP_TSTAMP_PRECISION_MICRO should be specified if
     the packets to be written have time stamps in seconds and microseconds,
     and PCAP_TSTAMP_PRECISION_NANO should be specified if the packets to be
     written have time stamps in seconds and nanoseconds.  Its value does not
     affect pcap_compile(3).

BACKWARD COMPATIBILITY

     The pcap_open_dead_with_tstamp_precision() function became available in
     libpcap release 1.5.1.  In previous releases, there was no mechanism to
     open a savefile for writing with time stamps given in seconds and
     nanoseconds.

SEE ALSO

     pcap(3), pcap-linktype(7)

                                3 January 2014               PCAP_OPEN_DEAD(3)