PCAP\_OPEN\_LIVE(3PCAP) PCAP\_OPEN\_LIVE(3PCAP) # [NAME](#NAME) pcap\_open\_live - open a device for capturing # [SYNOPSIS](#SYNOPSIS) ``` #include ``` ``` char errbuf[PCAP_ERRBUF_SIZE]; ``` ``` pcap_t *pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, char *errbuf); ``` # [DESCRIPTION](#DESCRIPTION) **pcap\_open\_live**() is used to obtain a packet capture handle to capture packets on a device (typically a network interface, see [**pcap\_findalldevs**(3PCAP)](/man/os/libpcap/pcap_findalldevs.3PCAP) for a more detailed explanation). *device* is a string that specifies the capture device to open; in this function, a null pointer means the same as the string "any". *snaplen* specifies the snapshot length to be set on the handle. If the packet data should not be truncated at the end, a value of 262144 should be sufficient for most devices, but D-Bus devices require a value of 128MiB (128\*1024\*1024). *promisc* specifies whether the device is to be put into promiscuous mode. If *promisc* is non-zero, promiscuous mode will be set, otherwise it will not be set. *to\_ms* specifies the packet buffer timeout, as a non-negative value, in milliseconds. (See [**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP) for an explanation of the packet buffer timeout.) *errbuf* is a buffer large enough to hold at least **PCAP\_ERRBUF\_SIZE** chars. # [RETURN VALUE](#RETURN_VALUE) **pcap\_open\_live**() returns a **pcap\_t \*** on success and a null pointer on failure. If a null pointer is returned, *errbuf* is filled in with an appropriate error message. *errbuf* may also be set to warning text when **pcap\_open\_live**() succeeds; to detect this case the caller should store a zero-length string in *errbuf* before calling **pcap\_open\_live**() and display the warning to the user if *errbuf* is no longer a zero-length string. # [SEE ALSO](#SEE_ALSO) [**pcap\_create**(3PCAP)](/man/os/libpcap/pcap_create.3PCAP), [**pcap\_activate**(3PCAP)](/man/os/libpcap/pcap_activate.3PCAP) 6 September 2026 --- Document: pcap_open_live(3pcap) from libpcap 1.11.0-r0 (Chainguard OS) Source: https://github.com/the-tcpdump-group/libpcap.git