PCAP\_CREATE(3PCAP) PCAP\_CREATE(3PCAP)

# [NAME](#NAME)

pcap\_create - create a live capture handle

# [SYNOPSIS](#SYNOPSIS)

```
#include <pcap/pcap.h>
```

```


char errbuf[PCAP_ERRBUF_SIZE];
```

```
pcap_t *pcap_create(const char *source, char *errbuf);
```

# [DESCRIPTION](#DESCRIPTION)

**pcap\_create**() is used to create a packet capture handle to capture packets on a device (typically a network interface, see [**pcap\_findalldevs**(3PCAP)](/man/os/libpcap/pcap_findalldevs.3PCAP) for a more detailed explanation). *source* is a string that specifies the capture device to open; in this function, a null pointer means the same as the string "any". *errbuf* is a buffer large enough to hold at least **PCAP\_ERRBUF\_SIZE** chars.

The returned handle must be activated with [**pcap\_activate**(3PCAP)](/man/os/libpcap/pcap_activate.3PCAP) before packets can be captured with it; options for the capture, such as promiscuous mode, can be set on the handle before activating it.

# [RETURN VALUE](#RETURN_VALUE)

**pcap\_create**() returns a **pcap\_t \*** on success and a null pointer on failure. If a null pointer is returned, *errbuf* is filled in with an appropriate error message.

# [SEE ALSO](#SEE_ALSO)

[**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP)

6 September 2026

---

Document: pcap_create(3pcap) from libpcap 1.11.0-r0 (Chainguard OS)
Source: https://github.com/the-tcpdump-group/libpcap.git