---
name: "pcap_set_protocol_linux"
section: "3pcap"
platform: "macos"
package: "libpcap"
version: "146"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_set_protocol_linux"
---

# pcap\_set\_protocol\_linux(3pcap)

set capture protocol for a not-yet-activated capture handle

## NAME

pcap\_set\_protocol\_linux - set capture protocol for a not-yet-activated capture handle

## SYNOPSIS

```
#include <pcap/pcap.h>
```

**int pcap\_set\_protocol\_linux(pcap\_t \*p, int protocol);**

## DESCRIPTION

**On network interface devices on Linux,** **pcap\_set\_protocol\_linux**() **sets the protocol to be used in the** [**socket**(2)](/socket/2.md) **call to create a capture socket when the handle is activated.  The** **argument is a link-layer protocol value, such as the values in the** **\<linux/if\_ether.h\>** **header file, specified in host byte order.** **If** *protocol* **is non-zero, packets of that protocol will be captured when the** **handle is activated, otherwise, all packets will be captured.  This** **function is only provided on Linux, and, if it is used on any device** **other than a network interface, it will have no effect.**

**It should not be used in portable code; instead, a filter should be** **specified with** **pcap\_setfilter**(3PCAP).

**If a given network interface provides a standard link-layer header, with** **a standard packet type, but provides some packet types with a different** **socket-layer protocol type from the one in the link-layer header, that** **packet type cannot be filtered with a filter specified with** **pcap\_setfilter**() **but can be filtered by specifying the socket-layer protocol type using** **pcap\_set\_protocol\_linux**().

## RETURN VALUE

**pcap\_set\_protocol\_linux**() **returns** **0** **on success or** **PCAP\_ERROR\_ACTIVATED** **if called on a capture handle that has been activated.**

## BACKWARD COMPATIBILITY

**This function became available in libpcap release 1.9.0.**

## SEE ALSO

**pcap**(3PCAP), **pcap\_create**(3PCAP), **pcap\_activate**(3PCAP)