pcap_offline_filter(3pcap) — Linux manual page



NAME         top

       pcap_offline_filter - check whether a filter matches a packet

SYNOPSIS         top

       #include <pcap/pcap.h>

       int pcap_offline_filter(const struct bpf_program *fp,
           const struct pcap_pkthdr *h, const u_char *pkt);

DESCRIPTION         top

       pcap_offline_filter() checks whether a filter matches a packet.
       fp is a pointer to a bpf_program struct, usually the result of a
       call to pcap_compile(3PCAP).  h points to the pcap_pkthdr
       structure for the packet, and pkt points to the data in the

RETURN VALUE         top

       pcap_offline_filter() returns the return value of the filter
       program.  This will be zero if the packet doesn't match the
       filter and non-zero if the packet matches the filter.

SEE ALSO         top


COLOPHON         top

       This page is part of the libpcap (packet capture library)
       project.  Information about the project can be found at 
       ⟨http://www.tcpdump.org/⟩.  If you have a bug report for this
       manual page, see ⟨http://www.tcpdump.org/#patches⟩.  This page
       was obtained from the project's upstream Git repository
       ⟨https://github.com/the-tcpdump-group/libpcap.git⟩ on 2023-12-22.
       (At that time, the date of the most recent commit that was found
       in the repository was 2023-12-13.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there
       is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to

                              7 April 2014    PCAP_OFFLINE_FILTER(3PCAP)