---
name: "pcap_setfilter"
section: "3pcap"
platform: "linux"
package: "libpcap"
version: "1.11.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/pcap_setfilter/3pcap"
---

# pcap\_setfilter(3pcap)

set the filter

## NAME

pcap\_setfilter - set the filter

## SYNOPSIS

```
#include <pcap/pcap.h>
```

**int pcap\_setfilter(pcap\_t \*p, struct bpf\_program \*fp);**

## DESCRIPTION

**pcap\_setfilter**() is used to specify a filter program. *fp* is a pointer to a **bpf\_program** structure, usually the result of a call to **pcap\_compile**(3PCAP). The structure members have the same meaning as in **pcap\_offline\_filter**(3PCAP), except in **pcap\_setfilter**() *fp.bf\_insns* must be a non-null pointer.  In other words, any successful result of **pcap\_compile**() is always valid in **pcap\_setfilter**().

If the calls to **pcap\_compile**() and **pcap\_setfilter**() use the same **pcap\_t** handle, packet filtering should either work correctly or fail correctly without additional efforts.  Otherwise the filter program must have been compiled for the same link-layer header type as the one used by the **pcap\_t** handle, also on Linux any usage of BPF extensions must match the use case. Specifically, if the **pcap\_t** stands for an input savefile, the filter program must not use the extensions, but if it stands for a live packet capture, the filter program may use the extensions if necessary.  See **pcap\_compile**() for more information.

## RETURN VALUE

**pcap\_setfilter**() returns **0** on success, **PCAP\_ERROR\_NOT\_ACTIVATED** if called on a capture handle that has been created but not activated, or **PCAP\_ERROR** on other errors.  If **PCAP\_ERROR** is returned, **pcap\_geterr**(3PCAP) or **pcap\_perror**(3PCAP) may be called with *p* as an argument to fetch or display the error text.

## SEE ALSO

**pcap**(3PCAP)