---
name: "pcap_create"
section: "3pcap"
platform: "linux"
package: "libpcap"
version: "1.11.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_create/3pcap"
---

# pcap\_create(3pcap)

create a live capture handle

## NAME

pcap\_create - create a live capture handle

## SYNOPSIS

```
#include <pcap/pcap.h>
```

```
char errbuf[PCAP_ERRBUF_SIZE];
```

**pcap\_t \*pcap\_create(const char \*source, char \*errbuf);**

## DESCRIPTION

**pcap\_create**() is used to create a packet capture handle to capture packets on a device (typically a network interface, see **pcap\_findalldevs**(3PCAP) for a more detailed explanation). *source* is a string that specifies the capture device to open; in this function, a null pointer means the same as the string "any". *errbuf* is a buffer large enough to hold at least **PCAP\_ERRBUF\_SIZE** chars.

The returned handle must be activated with **pcap\_activate**(3PCAP) before packets can be captured with it; options for the capture, such as promiscuous mode, can be set on the handle before activating it.

## RETURN VALUE

**pcap\_create**() returns a **pcap\_t \*** on success and a null pointer on failure. If a null pointer is returned, *errbuf* is filled in with an appropriate error message.

## SEE ALSO

**pcap**(3PCAP)