--- name: "pcap_open_live" section: "3pcap" platform: "linux" package: "libpcap" version: "1.11.0-1" release: "Arch Linux 2026-11-01" platforms: ["linux", "macos"] url: "https://new.carta.tech/pcap_open_live/3pcap" --- # pcap\_open\_live(3pcap) open a device for capturing ## NAME pcap\_open\_live - open a device for capturing ## SYNOPSIS ``` #include ``` ``` char errbuf[PCAP_ERRBUF_SIZE]; ``` **pcap\_t \*pcap\_open\_live(const char \*device, int snaplen,**\ **int promisc, int to\_ms, char \*errbuf);** ## DESCRIPTION **pcap\_open\_live**() is used to obtain a packet capture handle to capture packets on a device (typically a network interface, see **pcap\_findalldevs**(3PCAP) for a more detailed explanation). *device* is a string that specifies the capture device to open; in this function, a null pointer means the same as the string "any". *snaplen* specifies the snapshot length to be set on the handle. If the packet data should not be truncated at the end, a value of 262144 should be sufficient for most devices, but D-Bus devices require a value of 128MiB (128\*1024\*1024). *promisc* specifies whether the device is to be put into promiscuous mode. If *promisc* is non-zero, promiscuous mode will be set, otherwise it will not be set. *to\_ms* specifies the packet buffer timeout, as a non-negative value, in milliseconds. (See **pcap**(3PCAP) for an explanation of the packet buffer timeout.) *errbuf* is a buffer large enough to hold at least **PCAP\_ERRBUF\_SIZE** chars. ## RETURN VALUE **pcap\_open\_live**() returns a **pcap\_t \*** on success and a null pointer on failure. If a null pointer is returned, *errbuf* is filled in with an appropriate error message. *errbuf* may also be set to warning text when **pcap\_open\_live**() succeeds; to detect this case the caller should store a zero-length string in *errbuf* before calling **pcap\_open\_live**() and display the warning to the user if *errbuf* is no longer a zero-length string. ## SEE ALSO **pcap\_create**(3PCAP), **pcap\_activate**(3PCAP)