---
name: "pcap_offline_filter"
section: "3pcap"
platform: "macos"
package: "libpcap"
version: "146"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_offline_filter/3pcap"
---

# pcap\_offline\_filter(3pcap)

check whether a filter matches a packet

## NAME

pcap\_offline\_filter - check whether a filter matches a packet

## SYNOPSIS

```
#include <pcap/pcap.h>
```

**int pcap\_offline\_filter(const struct bpf\_program \*fp,** **const struct pcap\_pkthdr \*h, const u\_char \*pkt)**

## DESCRIPTION

**pcap\_offline\_filter**() checks whether a filter matches a packet. *fp* is a pointer to a *bpf\_program* struct, usually the result of a call to **pcap\_compile**(3PCAP). *h* points to the *pcap\_pkthdr* structure for the packet, and *pkt* points to the data in the packet.

## RETURN VALUE

**pcap\_offline\_filter**() returns the return value of the filter program.  This will be zero if the packet doesn't match the filter and non-zero if the packet matches the filter.

## SEE ALSO

**pcap**(3PCAP)