---
name: "pcap_create"
section: "3"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/pcap_create"
---

# pcap\_create(3)

create a live capture handle

## NAME

pcap\_create - create a live capture handle

## SYNOPSIS

```
#include <pcap/pcap.h>
```

```
char errbuf[PCAP_ERRBUF_SIZE];
```

**pcap\_t \*pcap\_create(const char \*source, char \*errbuf);**

## DESCRIPTION

**pcap\_create**() is used to create a packet capture handle to look at packets on the network. *source* is a string that specifies the network device to open; on Linux systems with 2.2 or later kernels, a *source* argument of "any" or **NULL** can be used to capture packets from all interfaces. *errbuf* is a buffer large enough to hold at least **PCAP\_ERRBUF\_SIZE** chars.

The returned handle must be activated with [**pcap\_activate**(3)](/pcap_activate/3.md) before packets can be captured with it; options for the capture, such as promiscuous mode, can be set on the handle before activating it.

## RETURN VALUE

**pcap\_create**() returns a **pcap\_t \*** on success and **NULL** on failure. If **NULL** is returned, *errbuf* is filled in with an appropriate error message.

## SEE ALSO

[**pcap**(3)](/pcap/3.md)