PCAP\_NEXT\_EX(3PCAP) PCAP\_NEXT\_EX(3PCAP) # [NAME](#NAME) pcap\_next\_ex, pcap\_next - read the next packet from a pcap\_t # [SYNOPSIS](#SYNOPSIS) ``` #include ``` ``` int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header, const u_char **pkt_data); const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h); ``` # [DESCRIPTION](#DESCRIPTION) **pcap\_next\_ex**() reads the next packet and returns a success/failure indication. If the packet was read without problems, the pointer pointed to by the *pkt\_header* argument is set to point to the **pcap\_pkthdr** structure for the packet, and the pointer pointed to by the *pkt\_data* argument is set to point to the data in the packet. The **struct pcap\_pkthdr** and the packet data are not to be freed by the caller, and are not guaranteed to be valid after the next call to **pcap\_next\_ex**(), **pcap\_next**(), [**pcap\_loop**(3PCAP)](/man/os/libpcap/pcap_loop.3PCAP), or [**pcap\_dispatch**(3PCAP)](/man/os/libpcap/pcap_dispatch.3PCAP); if the code needs them to remain valid, it must make a copy of them. **pcap\_next**() reads the next packet (by calling **pcap\_dispatch**() with a *cnt* of 1) and returns a **u\_char** pointer to the data in that packet. The packet data is not to be freed by the caller, and is not guaranteed to be valid after the next call to **pcap\_next\_ex**(), **pcap\_next**(), **pcap\_loop**(), or **pcap\_dispatch**(); if the code needs it to remain valid, it must make a copy of it. The **pcap\_pkthdr** structure pointed to by *h* is filled in with the appropriate values for the packet. The bytes of data from the packet begin with a link-layer header. The format of the link-layer header is indicated by the return value of the [**pcap\_datalink**(3PCAP)](/man/os/libpcap/pcap_datalink.3PCAP) routine when handed the **pcap\_t** value also passed to **pcap\_loop**() or **pcap\_dispatch**(). *https://www.tcpdump.org/linktypes.html* lists the values **pcap\_datalink**() can return and describes the packet formats that correspond to those values. The value it returns will be valid for all packets received unless and until [**pcap\_set\_datalink**(3PCAP)](/man/os/libpcap/pcap_set_datalink.3PCAP) is called; after a successful call to **pcap\_set\_datalink**(), all subsequent packets will have a link-layer header of the type specified by the link-layer header type value passed to **pcap\_set\_datalink**(). Do **NOT** assume that the packets for a given capture or \`\`savefile\`\` will have any given link-layer header type, such as **DLT\_EN10MB** for Ethernet. For example, the "any" device on Linux will have a link-layer header type of **DLT\_LINUX\_SLL** or **DLT\_LINUX\_SLL2** even if all devices on the system at the time the "any" device is opened have some other data link type, such as **DLT\_EN10MB** for Ethernet. # [RETURN VALUE](#RETURN_VALUE) **pcap\_next\_ex**() returns **1** if the packet was read without problems, **0** if packets are being read from a live capture and the packet buffer timeout expired, **PCAP\_ERROR\_BREAK** if packets are being read from a \`\`savefile'' and there are no more packets to read from the savefile or if [**pcap\_breakloop**(3PCAP)](/man/os/libpcap/pcap_breakloop.3PCAP) has been called, **PCAP\_ERROR\_NOT\_ACTIVATED** if called on a capture handle that has been created but not activated, or **PCAP\_ERROR** if an error occurred while reading the packet. If **PCAP\_ERROR** is returned, [**pcap\_geterr**(3PCAP)](/man/os/libpcap/pcap_geterr.3PCAP) or [**pcap\_perror**(3PCAP)](/man/os/libpcap/pcap_perror.3PCAP) may be called with *p* as an argument to fetch or display the error text. **pcap\_next**() returns a pointer to the packet data on success, and returns a null pointer if an error occurred, or if no packets were read from a live capture (if, for example, they were discarded because they didn't pass the packet filter, or if, on platforms that support a packet buffer timeout that starts before any packets arrive, the timeout expires before any packets arrive, or if the file descriptor for the capture device is in non-blocking mode and no packets were available to be read), or if no more packets are available in a \`\`savefile''. Unfortunately, there is no way to determine whether an error occurred or not. # [SEE ALSO](#SEE_ALSO) [**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP) 6 September 2026 --- Document: pcap_next_ex(3pcap) from libpcap 1.11.0-r0 (Chainguard OS) Source: https://github.com/the-tcpdump-group/libpcap.git