PCAP\_FILE(3PCAP) PCAP\_FILE(3PCAP) # [NAME](#NAME) pcap\_file - get the standard I/O stream for a savefile being read # [SYNOPSIS](#SYNOPSIS) ``` #include ``` ``` FILE *pcap_file(pcap_t *p); ``` # [DESCRIPTION](#DESCRIPTION) **pcap\_file**() returns the standard I/O stream of the \`\`savefile'', if a \`\`savefile'' was opened with [**pcap\_open\_offline**(3PCAP)](/man/os/libpcap/pcap_open_offline.3PCAP), or a null pointer, if a network device was opened with [**pcap\_create**(3PCAP)](/man/os/libpcap/pcap_create.3PCAP) and [**pcap\_activate**(3PCAP)](/man/os/libpcap/pcap_activate.3PCAP), or with [**pcap\_open\_live**(3PCAP)](/man/os/libpcap/pcap_open_live.3PCAP). Note that the Packet Capture library is usually built with large file support, so the standard I/O stream of the \`\`savefile'' might refer to a file larger than 2 gigabytes; applications that use **pcap\_file**() should, if possible, use calls that support large files on the return value of **pcap\_file**() or the value returned by [**fileno**(3)](/man/os/libpcap/fileno.3) when passed the return value of **pcap\_file**(). # [SEE ALSO](#SEE_ALSO) [**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP) 6 September 2026 --- Document: pcap_file(3pcap) from libpcap 1.11.0-r0 (Chainguard OS) Source: https://github.com/the-tcpdump-group/libpcap.git