---
name: "pcap_open_live"
section: "3pcap"
platform: "macos"
package: "libpcap"
version: "146"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_open_live/3pcap"
---

# pcap\_open\_live(3pcap)

open a device for capturing

## NAME

pcap\_open\_live - open a device for capturing

## SYNOPSIS

```
#include <pcap/pcap.h>
```

```
char errbuf[PCAP_ERRBUF_SIZE];
```

**pcap\_t \*pcap\_open\_live(const char \*device, int snaplen,** **int promisc, int to\_ms, char \*errbuf);**

## DESCRIPTION

**pcap\_open\_live**() is used to obtain a packet capture handle to look at packets on the network. *device* is a string that specifies the network device to open; on Linux systems with 2.2 or later kernels, a *device* argument of "any" or **NULL** can be used to capture packets from all interfaces.

*snaplen* specifies the snapshot length to be set on the handle.

*promisc* specifies whether the interface is to be put into promiscuous mode. If *promisc* is non-zero, promiscuous mode will be set, otherwise it will not be set.

*to\_ms* specifies the packet buffer timeout, as a non-negative value, in milliseconds.  (See **pcap**(3PCAP) for an explanation of the packet buffer timeout.)

## RETURN VALUE

**pcap\_open\_live**() returns a *pcap\_t \** on success and **NULL** on failure. If **NULL** is returned, *errbuf* is filled in with an appropriate error message. *errbuf* may also be set to warning text when **pcap\_open\_live**() succeeds; to detect this case the caller should store a zero-length string in *errbuf* before calling **pcap\_open\_live**() and display the warning to the user if *errbuf* is no longer a zero-length string. *errbuf* is assumed to be able to hold at least **PCAP\_ERRBUF\_SIZE** chars.

## SEE ALSO

**pcap\_create**(3PCAP), **pcap\_activate**(3PCAP)