1PCAP_DUMP_OPEN(3PCAP)                                    PCAP_DUMP_OPEN(3PCAP)
2
3
4

NAME

6       pcap_dump_open, pcap_dump_open_append, pcap_dump_fopen - open a file to
7       which to write packets
8

SYNOPSIS

10       #include <pcap/pcap.h>
11
12       pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname);
13       pcap_dumper_t *pcap_dump_open_append(pcap_t *p, const char *fname);
14       pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *fp);
15

DESCRIPTION

17       pcap_dump_open() is called to open a ``savefile'' for  writing.   fname
18       specifies  the  name  of  the file to open. The file will have the same
19       format as those used by tcpdump(1) and tcpslice(1).  If the  file  does
20       not exist, it will be created; if the file exists, it will be truncated
21       and overwritten.  The name "-" is a synonym for stdout.
22
23       pcap_dump_fopen() is called to write data to an  existing  open  stream
24       fp;   this   stream   will   be   closed   by   a  subsequent  call  to
25       pcap_dump_close(3PCAP).  The stream is assumed to be at  the  beginning
26       of a file that has been newly created or truncated, so that writes will
27       start at the beginning of the file.  Note that on Windows, that  stream
28       should be opened in binary mode.
29
30       p  is  a  capture or ``savefile'' handle returned by an earlier call to
31       pcap_create(3PCAP)   and   activated   by   an    earlier    call    to
32       pcap_activate(3PCAP),    or    returned   by   an   earlier   call   to
33       pcap_open_offline(3PCAP),           pcap_open_live(3PCAP),           or
34       pcap_open_dead(3PCAP).   The time stamp precision, link-layer type, and
35       snapshot length from p are used as the  link-layer  type  and  snapshot
36       length of the output file.
37
38       pcap_dump_open_append()  is  like pcap_dump_open() but, if the file al‐
39       ready exists, and is a pcap file with the same byte order as  the  host
40       opening  the  file,  and  has the same time stamp precision, link-layer
41       header type, and snapshot length as p, it will write new packets at the
42       end of the file.
43

RETURN VALUE

45       A   pointer   to   a  pcap_dumper_t  structure  to  use  in  subsequent
46       pcap_dump(3PCAP) and pcap_dump_close(3PCAP) calls is returned  on  suc‐
47       cess.    NULL   is   returned   on   failure.   If  NULL  is  returned,
48       pcap_geterr(3PCAP) can be used to get the error text.
49

BACKWARD COMPATIBILITY

51       The pcap_dump_open_append() function became available  in  libpcap  re‐
52       lease  1.7.2.   In previous releases, there is no support for appending
53       packets to an existing savefile.
54

SEE ALSO

56       pcap(3PCAP), pcap-savefile(5)
57
58
59
60                                  3 July 2020            PCAP_DUMP_OPEN(3PCAP)
Impressum