PCAP\_OFFLINE\_FILTER(3PCAP) PCAP\_OFFLINE\_FILTER(3PCAP)

# [NAME](#NAME)

pcap\_offline\_filter - check whether a filter matches a packet

# [SYNOPSIS](#SYNOPSIS)

```
#include <pcap/pcap.h>
```

```
int pcap_offline_filter(const struct bpf_program *fp,


    const struct pcap_pkthdr *h, const u_char *pkt);
```

# [DESCRIPTION](#DESCRIPTION)

**pcap\_offline\_filter**() checks whether a filter matches a packet. *fp* is a pointer to a **bpf\_program** structure, usually the result of a call to [**pcap\_compile**(3PCAP)](/man/os/libpcap/pcap_compile.3PCAP). *h* points to the **pcap\_pkthdr** structure for the packet, and *pkt* points to the data in the packet.

In the **bpf\_program** structure the **bf\_insns** member is either a null pointer (which means to reject all packets) or points to an array of one or more **struct bpf\_insn** elements, in which case the **bf\_len** member must be set to the number of elements (this is what **pcap\_compile**() produces).

The filter program must have been compiled for a link-layer header type that matches the packet data; also on Linux the filter must not use BPF extensions, see **pcap\_compile**() for more information.

# [RETURN VALUE](#RETURN_VALUE)

**pcap\_offline\_filter**() returns the return value of the filter program. This will be zero if the packet doesn't match the filter and non-zero if the packet matches the filter.

# [BACKWARD COMPATIBILITY](#BACKWARD_COMPATIBILITY)

In libpcap releases before 1.10.7 this function ignored the provided **bf\_len** value.

# [SEE ALSO](#SEE_ALSO)

[**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP)

6 September 2026

---

Document: pcap_offline_filter(3pcap) from libpcap 1.11.0-r0 (Chainguard OS)
Source: https://github.com/the-tcpdump-group/libpcap.git