pcap_setfilter(3pcap) — Linux manual page

PCAP_SETFILTER(3PCAP)                               PCAP_SETFILTER(3PCAP)

NAME         top

       pcap_setfilter - set the filter

SYNOPSIS         top

       #include <pcap/pcap.h>

       int pcap_setfilter(pcap_t *p, struct bpf_program *fp);

DESCRIPTION         top

       pcap_setfilter() is used to specify a filter program.  fp is a
       pointer to a bpf_program struct, usually the result of a call to
       pcap_compile(3PCAP).

       If the calls to pcap_compile() and pcap_setfilter() use the same
       pcap_t handle, packet filtering should either work correctly or
       fail correctly without additional efforts.  Otherwise the filter
       program must have been compiled for the same link-layer header
       type as the one used by the pcap_t handle; also on Linux the
       filter must not use BPF extensions, see pcap_compile() for more
       information.

RETURN VALUE         top

       pcap_setfilter() returns 0 on success, PCAP_ERROR_NOT_ACTIVATED if
       called on a capture handle that has been created but not
       activated, or PCAP_ERROR on other errors.  If PCAP_ERROR is
       returned, pcap_geterr(3PCAP) or pcap_perror(3PCAP) may be called
       with p as an argument to fetch or display the error text.

SEE ALSO         top

       pcap(3PCAP)

COLOPHON         top

       This page is part of the libpcap (packet capture library) project.
       Information about the project can be found at 
       ⟨http://www.tcpdump.org/⟩.  If you have a bug report for this
       manual page, see ⟨http://www.tcpdump.org/#patches⟩.  This page was
       obtained from the project's upstream Git repository
       ⟨https://github.com/the-tcpdump-group/libpcap.git⟩ on 2025-02-02.
       (At that time, the date of the most recent commit that was found
       in the repository was 2025-01-31.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there is
       a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to
       man-pages@man7.org

                             24 January 2025        PCAP_SETFILTER(3PCAP)

HTML rendering created 2025-02-02 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH.