PCAP\_OPEN\_DEAD(3PCAP) PCAP\_OPEN\_DEAD(3PCAP) # [NAME](#NAME) pcap\_open\_dead, pcap\_open\_dead\_with\_tstamp\_precision - open a fake pcap\_t for compiling filters or opening a capture for output # [SYNOPSIS](#SYNOPSIS) ``` #include ``` ``` pcap_t *pcap_open_dead(int linktype, int snaplen); pcap_t *pcap_open_dead_with_tstamp_precision(int linktype, int snaplen, u_int precision); ``` # [DESCRIPTION](#DESCRIPTION) **pcap\_open\_dead**() and **pcap\_open\_dead\_with\_tstamp\_precision**() are used for creating a **pcap\_t** structure to use when calling the other functions in libpcap. It is typically used when just using libpcap for compiling BPF code; it can also be used if using [**pcap\_dump\_open**(3PCAP)](/man/os/libpcap/pcap_dump_open.3PCAP), [**pcap\_dump**(3PCAP)](/man/os/libpcap/pcap_dump.3PCAP), and [**pcap\_dump\_close**(3PCAP)](/man/os/libpcap/pcap_dump_close.3PCAP) to write a savefile if there is no **pcap\_t** that supplies the packets to be written. *linktype* specifies the link-layer type for the **pcap\_t**. *snaplen* specifies the snapshot length for the **pcap\_t**. When **pcap\_open\_dead\_with\_tstamp\_precision**(), is used to create a **pcap\_t** for use with **pcap\_dump\_open**(), *precision* specifies the time stamp precision for packets; **PCAP\_TSTAMP\_PRECISION\_MICRO** should be specified if the packets to be written have time stamps in seconds and microseconds, and **PCAP\_TSTAMP\_PRECISION\_NANO** should be specified if the packets to be written have time stamps in seconds and nanoseconds. Its value does not affect [**pcap\_compile**(3PCAP)](/man/os/libpcap/pcap_compile.3PCAP). # [BACKWARD COMPATIBILITY](#BACKWARD_COMPATIBILITY) The **pcap\_open\_dead\_with\_tstamp\_precision**() function became available in libpcap release 1.5.1. In previous releases, there was no mechanism to open a savefile for writing with time stamps given in seconds and nanoseconds. # [SEE ALSO](#SEE_ALSO) [**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP), [**pcap-linktype**(7)](/man/os/libpcap/pcap-linktype.7) 3 January 2014 --- Document: pcap_open_dead(3pcap) from libpcap 1.11.0-r0 (Chainguard OS) Source: https://github.com/the-tcpdump-group/libpcap.git