---
name: "pcap_create"
section: "3pcap"
platform: "macos"
package: "libpcap"
version: "146"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_create/3pcap"
---

# pcap\_create(3pcap)

create a live capture handle

## NAME

pcap\_create - create a live capture handle

## SYNOPSIS

```
#include <pcap/pcap.h>
```

```
char errbuf[PCAP_ERRBUF_SIZE];
```

**pcap\_t \*pcap\_create(const char \*source, char \*errbuf);**

## DESCRIPTION

**pcap\_create**() is used to create a packet capture handle to look at packets on the network. *source* is a string that specifies the network device to open; on Linux systems with 2.2 or later kernels, a *source* argument of "any" or **NULL** can be used to capture packets from all interfaces.

The returned handle must be activated with **pcap\_activate**(3PCAP) before packets can be captured with it; options for the capture, such as promiscuous mode, can be set on the handle before activating it.

## RETURN VALUE

**pcap\_create**() returns a *pcap\_t \** on success and **NULL** on failure. If **NULL** is returned, *errbuf* is filled in with an appropriate error message. *errbuf* is assumed to be able to hold at least **PCAP\_ERRBUF\_SIZE** chars.

## SEE ALSO

**pcap**(3PCAP)