1PCAP_OPEN_OFFLINE(3PCAP)                              PCAP_OPEN_OFFLINE(3PCAP)
2
3
4

NAME

6       pcap_open_offline,  pcap_fopen_offline  - open a saved capture file for
7       reading
8

SYNOPSIS

10       #include <pcap/pcap.h>
11
12       char errbuf[PCAP_ERRBUF_SIZE];
13
14       pcap_t *pcap_open_offline(const char *fname, char *errbuf);
15       pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf);
16

DESCRIPTION

18       pcap_open_offline() is called to open a ``savefile'' for reading.
19
20       fname specifies the name of the file to open. The  file  can  have  the
21       pcap  file  format  as described in pcap-savefile(5), which is the file
22       format used by, among other programs, tcpdump(1)  and  tcpslice(1),  or
23       can have the pcap-ng file format, although not all pcap-ng files can be
24       read.  The name "-" in a synonym for stdin.
25
26       Alternatively, you may call pcap_fopen_offline() to  read  dumped  data
27       from  an  existing  open  stream fp.  Note that on Windows, that stream
28       should be opened in binary mode.
29

RETURN VALUE

31       pcap_open_offline() and pcap_fopen_offline() return a pcap_t * on  suc‐
32       cess  and  NULL  on  failure.  If NULL is returned, errbuf is filled in
33       with an appropriate error message.  errbuf is assumed  to  be  able  to
34       hold at least PCAP_ERRBUF_SIZE chars.
35

SEE ALSO

37       pcap(3PCAP), pcap-savefile(5)
38
39
40
41                                 5 April 2008         PCAP_OPEN_OFFLINE(3PCAP)
Impressum