---
name: "pcap_datalink"
section: "3"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/pcap_datalink"
---

# pcap\_datalink(3)

get the link-layer header type

## NAME

pcap\_datalink - get the link-layer header type

## SYNOPSIS

```
#include <pcap/pcap.h>
```

**int pcap\_datalink(pcap\_t \*p);**

## DESCRIPTION

**pcap\_datalink**() returns the link-layer header type for the live capture or \`\`savefile'' specified by *p*.

It must not be called on a pcap descriptor created by [**pcap\_create**(3)](/pcap_create/3.md) that has not yet been activated by [**pcap\_activate**(3)](/pcap_activate/3.md).

*https://www.tcpdump.org/linktypes.html* lists the values **pcap\_datalink**() can return and describes the packet formats that correspond to those values.

Do **NOT** assume that the packets for a given capture or \`\`savefile\`\` will have any given link-layer header type, such as **DLT\_EN10MB** for Ethernet.  For example, the "any" device on Linux will have a link-layer header type of **DLT\_LINUX\_SLL** or **DLT\_LINUX\_SLL2** even if all devices on the system at the time the "any" device is opened have some other data link type, such as **DLT\_EN10MB** for Ethernet.

## RETURN VALUE

**pcap\_datalink**() returns the link-layer header type on success and **PCAP\_ERROR\_NOT\_ACTIVATED** if called on a capture handle that has been created but not activated.

## SEE ALSO

[**pcap**(3)](/pcap/3.md), [**pcap-linktype**(7)](/pcap-linktype/7.md)