---
name: "pcap_offline_filter"
section: "3pcap"
platform: "linux"
package: "libpcap"
version: "1.11.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_offline_filter/3pcap"
---

# pcap\_offline\_filter(3pcap)

check whether a filter matches a packet

## NAME

pcap\_offline\_filter - check whether a filter matches a packet

## SYNOPSIS

```
#include <pcap/pcap.h>
```

**int pcap\_offline\_filter(const struct bpf\_program \*fp,**\
     **const struct pcap\_pkthdr \*h, const u\_char \*pkt);**

## DESCRIPTION

**pcap\_offline\_filter**() checks whether a filter matches a packet. *fp* is a pointer to a **bpf\_program** structure, usually the result of a call to **pcap\_compile**(3PCAP). *h* points to the **pcap\_pkthdr** structure for the packet, and *pkt* points to the data in the packet.

In the **bpf\_program** structure the **bf\_insns** member is either a null pointer (which means to reject all packets) or points to an array of one or more **struct bpf\_insn** elements, in which case the **bf\_len** member must be set to the number of elements (this is what **pcap\_compile**() produces).

The filter program must have been compiled for a link-layer header type that matches the packet data; also on Linux the filter must not use BPF extensions, see **pcap\_compile**() for more information.

## RETURN VALUE

**pcap\_offline\_filter**() returns the return value of the filter program.  This will be zero if the packet doesn't match the filter and non-zero if the packet matches the filter.

## BACKWARD COMPATIBILITY

In libpcap releases before 1.10.7 this function ignored the provided **bf\_len** value.

## SEE ALSO

**pcap**(3PCAP)