---
name: "pcap_datalink"
section: "3pcap"
platform: "linux"
package: "libpcap"
version: "1.11.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_datalink/3pcap"
---

# pcap\_datalink(3pcap)

get the link-layer header type

## NAME

pcap\_datalink - get the link-layer header type

## SYNOPSIS

```
#include <pcap/pcap.h>
```

**int pcap\_datalink(pcap\_t \*p);**

## DESCRIPTION

**pcap\_datalink**() returns the link-layer header type for the live capture or \`\`savefile'' specified by *p*.

It must not be called on a pcap descriptor created by **pcap\_create**(3PCAP) that has not yet been activated by **pcap\_activate**(3PCAP).

*https://www.tcpdump.org/linktypes.html* lists the values **pcap\_datalink**() can return and describes the packet formats that correspond to those values.

Do **NOT** assume that the packets for a given capture or \`\`savefile\`\` will have any given link-layer header type, such as **DLT\_EN10MB** for Ethernet.  For example, the "any" device on Linux will have a link-layer header type of **DLT\_LINUX\_SLL** or **DLT\_LINUX\_SLL2** even if all devices on the system at the time the "any" device is opened have some other data link type, such as **DLT\_EN10MB** for Ethernet.

## RETURN VALUE

**pcap\_datalink**() returns the link-layer header type on success and **PCAP\_ERROR\_NOT\_ACTIVATED** if called on a capture handle that has been created but not activated.

## SEE ALSO

**pcap**(3PCAP), **pcap\_datalink\_val\_to\_name**(3PCAP), **pcap\_set\_datalink**(3PCAP), **pcap\_list\_datalinks**(3PCAP), [**pcap-linktype**(7)](/pcap-linktype/7.md)