PCAP\_SETFILTER(3PCAP) PCAP\_SETFILTER(3PCAP) # [NAME](#NAME) pcap\_setfilter - set the filter # [SYNOPSIS](#SYNOPSIS) ``` #include ``` ``` int pcap_setfilter(pcap_t *p, struct bpf_program *fp); ``` # [DESCRIPTION](#DESCRIPTION) **pcap\_setfilter**() is used to specify a filter program. *fp* is a pointer to a **bpf\_program** structure, usually the result of a call to [**pcap\_compile**(3PCAP)](/man/os/libpcap/pcap_compile.3PCAP). The structure members have the same meaning as in [**pcap\_offline\_filter**(3PCAP)](/man/os/libpcap/pcap_offline_filter.3PCAP), except in **pcap\_setfilter**() *fp.bf\_insns* must be a non-null pointer. In other words, any successful result of **pcap\_compile**() is always valid in **pcap\_setfilter**(). If the calls to **pcap\_compile**() and **pcap\_setfilter**() use the same **pcap\_t** handle, packet filtering should either work correctly or fail correctly without additional efforts. Otherwise the filter program must have been compiled for the same link-layer header type as the one used by the **pcap\_t** handle, also on Linux any usage of BPF extensions must match the use case. Specifically, if the **pcap\_t** stands for an input savefile, the filter program must not use the extensions, but if it stands for a live packet capture, the filter program may use the extensions if necessary. See **pcap\_compile**() for more information. # [RETURN VALUE](#RETURN_VALUE) **pcap\_setfilter**() returns **0** on success, **PCAP\_ERROR\_NOT\_ACTIVATED** if called on a capture handle that has been created but not activated, or **PCAP\_ERROR** on other errors. If **PCAP\_ERROR** is returned, [**pcap\_geterr**(3PCAP)](/man/os/libpcap/pcap_geterr.3PCAP) or [**pcap\_perror**(3PCAP)](/man/os/libpcap/pcap_perror.3PCAP) may be called with *p* as an argument to fetch or display the error text. # [SEE ALSO](#SEE_ALSO) [**pcap**(3PCAP)](/man/os/libpcap/pcap.3PCAP) 11 September 2026 --- Document: pcap_setfilter(3pcap) from libpcap 1.11.0-r0 (Chainguard OS) Source: https://github.com/the-tcpdump-group/libpcap.git