FreeBSD Manual Pages
PCAP_OPEN_OFFLINE(3PCAP) PCAP_OPEN_OFFLINE(3PCAP) NAME pcap_open_offline, pcap_open_offline_with_tstamp_precision, pcap_fopen_offline, pcap_fopen_offline_with_tstamp_precision - open a saved capture file for reading SYNOPSIS #include <pcap/pcap.h> char errbuf[PCAP_ERRBUF_SIZE]; pcap_t *pcap_open_offline(const char *fname, char *errbuf); pcap_t *pcap_open_offline_with_tstamp_precision(const char *fname, u_int precision, char *errbuf); pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf); pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *fp, u_int precision, char *errbuf); DESCRIPTION pcap_open_offline() and pcap_open_offline_with_tstamp_precision() are called to open a ``savefile'' for reading. fname specifies the name of the file to open. The file can have the pcap file format as described in pcap-savefile(5), which is the file format used by, among other programs, tcpdump(1) and tcpslice(1), or can have the pcapng file format, although not all pcapng files can be read. The name "-" is a synonym for stdin. pcap_open_offline_with_tstamp_precision() takes an additional precision argument specifying the time stamp precision desired; if PCAP_TSTAMP_PRECISION_MICRO is specified, packet time stamps will be supplied in seconds and microseconds, and if PCAP_TSTAMP_PRECISION_NANO is specified, packet time stamps will be supplied in seconds and nanoseconds. If the time stamps in the file do not have the same pre- cision as the requested precision, they will be scaled up or down as necessary before being supplied. Alternatively, you may call pcap_fopen_offline() or pcap_fopen_of- fline_with_tstamp_precision() to read dumped data from an existing open stream fp. pcap_fopen_offline_with_tstamp_precision() takes an addi- tional precision argument as described above. Note that on Windows, that stream should be opened in binary mode. errbuf is a buffer large enough to hold at least PCAP_ERRBUF_SIZE chars. RETURN VALUE pcap_open_offline(), pcap_open_offline_with_tstamp_precision(), pcap_fopen_offline(), and pcap_fopen_offline_with_tstamp_precision() return a pcap_t * on success and NULL on failure. If NULL is returned, errbuf is filled in with an appropriate error message. BACKWARD COMPATIBILITY pcap_open_offline_with_tstamp_precision() and pcap_fopen_of- fline_with_tstamp_precision() became available in libpcap release 1.5.1. In previous releases, time stamps from a savefile are always given in seconds and microseconds. SEE ALSO pcap(3PCAP), pcap-savefile(5) 30 November 2023 PCAP_OPEN_OFFLINE(3PCAP)
NAME | SYNOPSIS | DESCRIPTION | RETURN VALUE | BACKWARD COMPATIBILITY | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=pcap_open_offline&sektion=3&manpath=FreeBSD+Ports+14.3.quarterly>