---
name: "pcap_open_live"
section: "3"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/pcap_open_live"
---

# pcap\_open\_live(3)

open a device for capturing

## NAME

pcap\_open\_live - open a device for capturing

## SYNOPSIS

```
#include <pcap/pcap.h>
```

```
char errbuf[PCAP_ERRBUF_SIZE];
```

**pcap\_t \*pcap\_open\_live(const char \*device, int snaplen,**\
     **int promisc, int to\_ms, char \*errbuf);**

## DESCRIPTION

**pcap\_open\_live**() is used to obtain a packet capture handle to look at packets on the network. *device* is a string that specifies the network device to open; on all supported Linux systems, as well as on recent versions of macOS and Solaris, a *device* argument of "any" or **NULL** can be used to capture packets from all network interfaces.  The latter should not be confused with all available capture devices as seen by [**pcap\_findalldevs**(3)](/pcap_findalldevs/3.md), which may also include D-Bus, USB etc.

*snaplen* specifies the snapshot length to be set on the handle.  If the packet data should not be truncated at the end, a value of 262144 should be sufficient for most devices, but D-Bus devices require a value of 128MB (128\*1024\*1024).

*promisc* specifies whether the interface is to be put into promiscuous mode. If *promisc* is non-zero, promiscuous mode will be set, otherwise it will not be set.

*to\_ms* specifies the packet buffer timeout, as a non-negative value, in milliseconds.  (See [**pcap**(3)](/pcap/3.md) for an explanation of the packet buffer timeout.)

*errbuf* is a buffer large enough to hold at least **PCAP\_ERRBUF\_SIZE** chars.

## RETURN VALUE

**pcap\_open\_live**() returns a **pcap\_t \*** on success and **NULL** on failure. If **NULL** is returned, *errbuf* is filled in with an appropriate error message. *errbuf* may also be set to warning text when **pcap\_open\_live**() succeeds; to detect this case the caller should store a zero-length string in *errbuf* before calling **pcap\_open\_live**() and display the warning to the user if *errbuf* is no longer a zero-length string.

## SEE ALSO

[**pcap\_create**(3)](/pcap_create/3.md), [**pcap\_activate**(3)](/pcap_activate/3.md)