---
name: "pcap_next"
section: "3pcap"
platform: "linux"
package: "libpcap"
version: "1.11.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/pcap_next_ex/3pcap"
---

# pcap\_next(3pcap)

read the next packet from a pcap\_t

Part of [pcap\_next\_ex(3pcap)](/pcap_next_ex/3pcap.md).

## NAME

pcap\_next\_ex, pcap\_next - read the next packet from a pcap\_t

## SYNOPSIS

```
#include <pcap/pcap.h>
```

**int pcap\_next\_ex(pcap\_t \*p, struct pcap\_pkthdr \*\*pkt\_header,**\
     **const u\_char \*\*pkt\_data);** **const u\_char \*pcap\_next(pcap\_t \*p, struct pcap\_pkthdr \*h);**

## DESCRIPTION

**pcap\_next\_ex**() reads the next packet and returns a success/failure indication. If the packet was read without problems, the pointer pointed to by the *pkt\_header* argument is set to point to the **pcap\_pkthdr** structure for the packet, and the pointer pointed to by the *pkt\_data* argument is set to point to the data in the packet.  The **struct pcap\_pkthdr** and the packet data are not to be freed by the caller, and are not guaranteed to be valid after the next call to **pcap\_next\_ex**(), **pcap\_next**(), **pcap\_loop**(3PCAP), or **pcap\_dispatch**(3PCAP); if the code needs them to remain valid, it must make a copy of them.

**pcap\_next**() reads the next packet (by calling **pcap\_dispatch**() with a *cnt* of 1) and returns a **u\_char** pointer to the data in that packet.  The packet data is not to be freed by the caller, and is not guaranteed to be valid after the next call to **pcap\_next\_ex**(), **pcap\_next**(), **pcap\_loop**(), or **pcap\_dispatch**(); if the code needs it to remain valid, it must make a copy of it. The **pcap\_pkthdr** structure pointed to by *h* is filled in with the appropriate values for the packet.

The bytes of data from the packet begin with a link-layer header.  The format of the link-layer header is indicated by the return value of the **pcap\_datalink**(3PCAP) routine when handed the **pcap\_t** value also passed to **pcap\_loop**() or **pcap\_dispatch**(). *https://www.tcpdump.org/linktypes.html* lists the values **pcap\_datalink**() can return and describes the packet formats that correspond to those values.  The value it returns will be valid for all packets received unless and until **pcap\_set\_datalink**(3PCAP) is called; after a successful call to **pcap\_set\_datalink**(), all subsequent packets will have a link-layer header of the type specified by the link-layer header type value passed to **pcap\_set\_datalink**().

Do **NOT** assume that the packets for a given capture or \`\`savefile\`\` will have any given link-layer header type, such as **DLT\_EN10MB** for Ethernet.  For example, the "any" device on Linux will have a link-layer header type of **DLT\_LINUX\_SLL** or **DLT\_LINUX\_SLL2** even if all devices on the system at the time the "any" device is opened have some other data link type, such as **DLT\_EN10MB** for Ethernet.

## RETURN VALUE

**pcap\_next\_ex**() returns **1** if the packet was read without problems, **0** if packets are being read from a live capture and the packet buffer timeout expired, **PCAP\_ERROR\_BREAK** if packets are being read from a \`\`savefile'' and there are no more packets to read from the savefile or if **pcap\_breakloop**(3PCAP) has been called, **PCAP\_ERROR\_NOT\_ACTIVATED** if called on a capture handle that has been created but not activated, or **PCAP\_ERROR** if an error occurred while reading the packet.  If **PCAP\_ERROR** is returned, **pcap\_geterr**(3PCAP) or **pcap\_perror**(3PCAP) may be called with *p* as an argument to fetch or display the error text.

**pcap\_next**() returns a pointer to the packet data on success, and returns a null pointer if an error occurred, or if no packets were read from a live capture (if, for example, they were discarded because they didn't pass the packet filter, or if, on platforms that support a packet buffer timeout that starts before any packets arrive, the timeout expires before any packets arrive, or if the file descriptor for the capture device is in non-blocking mode and no packets were available to be read), or if no more packets are available in a \`\`savefile''.  Unfortunately, there is no way to determine whether an error occurred or not.

## SEE ALSO

**pcap**(3PCAP)