pcap_offline_filter(3pcap) — Linux manual page

PCAP_OFFLINE_FILTER(3PCAP)                     PCAP_OFFLINE_FILTER(3PCAP)

NAME         top

       pcap_offline_filter - check whether a filter matches a packet

SYNOPSIS         top

       #include <pcap/pcap.h>

       int pcap_offline_filter(const struct bpf_program *fp,
           const struct pcap_pkthdr *h, const u_char *pkt);

DESCRIPTION         top

       pcap_offline_filter() checks whether a filter matches a packet.
       fp is a pointer to a bpf_program struct, usually the result of a
       call to pcap_compile(3PCAP).  h points to the pcap_pkthdr
       structure for the packet, and pkt points to the data in the
       packet.

       The filter program must have been compiled for a link-layer header
       type that matches the packet data; also on Linux the filter must
       not use BPF extensions, see pcap_compile() for more information.

RETURN VALUE         top

       pcap_offline_filter() returns the return value of the filter
       program.  This will be zero if the packet doesn't match the filter
       and non-zero if the packet matches the filter.

SEE ALSO         top

       pcap(3PCAP)

COLOPHON         top

       This page is part of the libpcap (packet capture library) project.
       Information about the project can be found at 
       ⟨http://www.tcpdump.org/⟩.  If you have a bug report for this
       manual page, see ⟨http://www.tcpdump.org/#patches⟩.  This page was
       obtained from the project's upstream Git repository
       ⟨https://github.com/the-tcpdump-group/libpcap.git⟩ on 2025-08-11.
       (At that time, the date of the most recent commit that was found
       in the repository was 2025-08-10.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there is
       a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to
       man-pages@man7.org

                             24 January 2025   PCAP_OFFLINE_FILTER(3PCAP)

HTML rendering created 2025-09-06 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH.