Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

pcap_dump_fopen(3pcap) [v7 man page]

PCAP_DUMP_OPEN(3PCAP)													     PCAP_DUMP_OPEN(3PCAP)

NAME
pcap_dump_open, pcap_dump_fopen - open a file to which to write packets SYNOPSIS
#include <pcap/pcap.h> pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname); pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *fp); DESCRIPTION
pcap_dump_open() is called to open a ``savefile'' for writing. fname specifies the name of the file to open. The file will have the same format as those used by tcpdump(1) and tcpslice(1). The name "-" in a synonym for stdout. pcap_dump_fopen() is called to write data to an existing open stream fp. Note that on Windows, that stream should be opened in binary mode. p is a capture or ``savefile'' handle returned by an earlier call to pcap_create() and activated by an earlier call to pcap_activate(), or returned by an earlier call to pcap_open_offline(), pcap_open_live(), or pcap_open_dead(). The link-layer type and snapshot length from p are used as the link-layer type and snapshot length of the output file. RETURN VALUES
A pointer to a pcap_dumper_t structure to use in subsequent pcap_dump() and pcap_dump_close() calls is returned on success. NULL is returned on failure. If NULL is returned, pcap_geterr(p) can be used to get the error text. SEE ALSO
pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP), pcap_open_offline(3PCAP), pcap_open_live(3PCAP), pcap_open_dead(3PCAP), pcap_dump(3PCAP), pcap_dump_close(3PCAP), pcap_geterr(3PCAP), pcap-savefile(5) 5 April 2008 PCAP_DUMP_OPEN(3PCAP)

Check Out this Related Man Page

PCAP_OPEN_OFFLINE(3PCAP)												  PCAP_OPEN_OFFLINE(3PCAP)

NAME
pcap_open_offline, pcap_open_offline_with_tstamp_precision, pcap_fopen_offline, pcap_fopen_offline_with_tstamp_precision - open a saved capture file for reading SYNOPSIS
#include <pcap/pcap.h> char errbuf[PCAP_ERRBUF_SIZE]; pcap_t *pcap_open_offline(const char *fname, char *errbuf); pcap_t *pcap_open_offline_with_tstamp_precision(const char *fname, u_int precision, char *errbuf); pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf); pcap_t *pcap_fopen_offline_with_tstamp_precision(FILE *fp, u_int precision, char *errbuf); DESCRIPTION
pcap_open_offline() and pcap_open_offline_with_tstamp_precision() are called to open a ``savefile'' for reading. fname specifies the name of the file to open. The file can have the pcap file format as described in pcap-savefile(5@), which is the file format used by, among other programs, tcpdump(1) and tcpslice(1), or can have the pcap-ng file format, although not all pcap-ng files can be read. The name "-" is a synonym for stdin. pcap_open_offline_with_tstamp_precision() takes an additional precision argument specifying the time stamp precision desired; if PCAP_TSTAMP_PRECISION_MICRO is specified, packet time stamps will be supplied in seconds and microseconds, and if PCAP_TSTAMP_PRECI- SION_NANO is specified, packet time stamps will be supplied in seconds and nanoseconds. If the time stamps in the file do not have the same precision as the requested precision, they will be scaled up or down as necessary before being supplied. Alternatively, you may call pcap_fopen_offline() or pcap_fopen_offline_with_tstamp_precision() to read dumped data from an existing open stream fp. pcap_fopen_offline_with_tstamp_precision() takes an additional precision argument as described above. Note that on Windows, that stream should be opened in binary mode. RETURN VALUE
pcap_open_offline(), pcap_open_offline_with_tstamp_precision(), pcap_fopen_offline(), and pcap_fopen_offline_with_tstamp_precision() return a pcap_t * on success and NULL on failure. If NULL is returned, errbuf is filled in with an appropriate error message. errbuf is assumed to be able to hold at least PCAP_ERRBUF_SIZE chars. SEE ALSO
pcap(3PCAP), pcap-savefile(5@) 3 January 2014 PCAP_OPEN_OFFLINE(3PCAP)
Man Page