PCAP\_DATALINK(3PCAP) PCAP\_DATALINK(3PCAP) # [NAME](#NAME) pcap\_datalink - get the link-layer header type # [SYNOPSIS](#SYNOPSIS) ``` #include ``` ``` int pcap_datalink(pcap_t *p); ``` # [DESCRIPTION](#DESCRIPTION) **pcap\_datalink**() returns the link-layer header type for the live capture or \`\`savefile'' specified by *p*. It must not be called on a pcap descriptor created by [**pcap\_create**(3PCAP)](/man/os/libpcap/pcap_create.3PCAP) that has not yet been activated by [**pcap\_activate**(3PCAP)](/man/os/libpcap/pcap_activate.3PCAP). *https://www.tcpdump.org/linktypes.html* lists the values **pcap\_datalink**() can return and describes the packet formats that correspond to those values. Do **NOT** assume that the packets for a given capture or \`\`savefile\`\` will have any given link-layer header type, such as **DLT\_EN10MB** for Ethernet. For example, the "any" device on Linux will have a link-layer header type of **DLT\_LINUX\_SLL** or **DLT\_LINUX\_SLL2** even if all devices on the system at the time the "any" device is opened have some other data link type, such as **DLT\_EN10MB** for Ethernet. # [RETURN VALUE](#RETURN_VALUE) **pcap\_datalink**() returns the link-layer header type on success and **PCAP\_ERROR\_NOT\_ACTIVATED** if called on a capture handle that has been created but not activated. # [SEE ALSO](#SEE_ALSO) [**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP), [**pcap\_datalink\_val\_to\_name**(3PCAP)](/man/os/libpcap/pcap_datalink_val_to_name.3PCAP), [**pcap\_set\_datalink**(3PCAP)](/man/os/libpcap/pcap_set_datalink.3PCAP), [**pcap\_list\_datalinks**(3PCAP)](/man/os/libpcap/pcap_list_datalinks.3PCAP), [**pcap-linktype**(7)](/man/os/libpcap/pcap-linktype.7) 7 April 2014 --- Document: pcap_datalink(3pcap) from libpcap 1.11.0-r0 (Chainguard OS) Source: https://github.com/the-tcpdump-group/libpcap.git