pcap-linktype(7) [v7 man page]

PCAP-LINKTYPE(7)					 Miscellaneous Information Manual					  PCAP-LINKTYPE(7)

NAME

       pcap-linktype - link-layer header types supported by libpcap

DESCRIPTION

       For  a  live capture or ``savefile'', libpcap supplies, as the return value of the pcap_datalink(3PCAP) routine, a value that indicates the
       type of link-layer header at the beginning of the packets it provides.  This is not necessarily the type  of  link-layer  header  that  the
       packets	being  captured  have  on the network from which they're being captured; for example, packets from an IEEE 802.11 network might be
       provided by libpcap with Ethernet headers that the network adapter or the network adapter driver generates from the  802.11  headers.   The
       names for those values begin with DLT_, so they are sometimes called "DLT_ values".

       The  values  stored  in	the  link-layer  header  type  field in the savefile header are, in most but not all cases, the same as the values
       returned by pcap_datalink().  The names for those values begin with LINKTYPE_.

       The link-layer header types supported by libpcap are described at http://www.tcpdump.org/linktypes.html.

SEE ALSO

       pcap_datalink(3PCAP)

								  23 October 2008						  PCAP-LINKTYPE(7)

PCAP_DATALINK(3PCAP)													      PCAP_DATALINK(3PCAP)

NAME

       pcap_datalink - get the link-layer header type

SYNOPSIS

       #include <pcap/pcap.h>

       int pcap_datalink(pcap_t *p);

DESCRIPTION

       pcap_datalink() returns the link-layer header type for the live capture or ``savefile'' specified by p.

       It must not be called on a pcap descriptor created by pcap_create() that has not yet been activated by pcap_activate().

       http://www.tcpdump.org/linktypes.html lists the values pcap_datalink() can return and describes the packet formats that correspond to those
       values.

       Do NOT assume that the packets for a given capture or ``savefile`` will have any given link-layer header type, such as DLT_EN10MB for  Eth-
       ernet.  For example, the "any" device on Linux will have a link-layer header type of DLT_LINUX_SLL even if all devices on the system at the
       time the "any" device is opened have some other data link type, such as DLT_EN10MB for Ethernet.

RETURN VALUE

       pcap_datalink() returns the link-layer header type on success and PCAP_ERROR_NOT_ACTIVATED if called on a capture handle that has been cre-
       ated but not activated.

SEE ALSO

       pcap(3PCAP), pcap-linktype(7)

								   7 April 2014 					      PCAP_DATALINK(3PCAP)