1PCAP_DUMP_OPEN(3PCAP)                                    PCAP_DUMP_OPEN(3PCAP)
2
3
4

NAME

6       pcap_dump_open, pcap_dump_open_append, pcap_dump_fopen - open a file to
7       which to write packets
8

SYNOPSIS

10       #include <pcap/pcap.h>
11
12       pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname);
13       pcap_dumper_t *pcap_dump_open_append(pcap_t *p, const char *fname);
14       pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *fp);
15

DESCRIPTION

17       pcap_dump_open() is called to open a ``savefile'' for  writing.   fname
18       specifies  the  name  of  the file to open. The file will have the same
19       format as those used by tcpdump(1) and tcpslice(1).  If the  file  does
20       not exist, it will be created; if the file exists, it will be truncated
21       and overwritten.  The name "-" is a synonym for stdout.
22
23       pcap_dump_fopen() is called to write data to an  existing  open  stream
24       fp;   this   stream   will   be   closed   by   a  subsequent  call  to
25       pcap_dump_close(3PCAP).  The stream is assumed to be at  the  beginning
26       of a file that has been newly created or truncated, so that writes will
27       start at the beginning of the file.  Note that on Windows, that  stream
28       should be opened in binary mode.
29
30       p  is  a  capture or ``savefile'' handle returned by an earlier call to
31       pcap_create(3PCAP)   and   activated   by   an    earlier    call    to
32       pcap_activate(3PCAP),    or    returned   by   an   earlier   call   to
33       pcap_open_offline(3PCAP),           pcap_open_live(3PCAP),           or
34       pcap_open_dead(3PCAP).   The time stamp precision, link-layer type, and
35       snapshot length from p are used as the  link-layer  type  and  snapshot
36       length of the output file.
37
38       pcap_dump_open_append()  is  like  pcap_dump_open()  but,  if  the file
39       already exists, and is a pcap file with the same byte order as the host
40       opening  the  file,  and  has the same time stamp precision, link-layer
41       header type, and snapshot length as p, it will write new packets at the
42       end of the file.
43

RETURN VALUES

45       A   pointer   to   a  pcap_dumper_t  structure  to  use  in  subsequent
46       pcap_dump(3PCAP) and pcap_dump_close(3PCAP) calls is returned  on  suc‐
47       cess.    NULL   is   returned   on   failure.   If  NULL  is  returned,
48       pcap_geterr(3PCAP) can be used to get the error text.
49

BACKWARD COMPATIBILITY

51       The  pcap_dump_open_append()  function  became  available  in   libpcap
52       release 1.7.2.  In previous releases, there is no support for appending
53       packets to an existing savefile.
54

SEE ALSO

56       pcap(3PCAP), pcap-savefile(5)
57
58
59
60                                  3 July 2020            PCAP_DUMP_OPEN(3PCAP)
Impressum