pcapopenlive

pcap_open_live is a function from the libpcap library that opens a live capture on a specified network device. It initializes a capture session and returns a handle (of type pcap_t) that is used by subsequent capture operations such as pcap_loop, pcap_dispatch, or pcap_next_ex. The function is available on platforms that support libpcap, including Unix-like systems and Windows (via WinPcap or Npcap).

The function takes five arguments: device is the name of the network interface to capture from; snaplen is the maximum number of bytes to capture from each packet; promisc selects promiscuous mode when nonzero, enabling the capture of all traffic seen on the network segment; to_ms is the read timeout in milliseconds, which influences how often the capture driver returns packets; and errbuf is a character buffer used to receive error messages (with a size of PCAP_ERRBUF_SIZE). If the call succeeds, a non-null pcap_t pointer is returned; on failure, NULL is returned and the error message is written to errbuf.

Usage considerations include that the returned handle must be closed with pcap_close when the capture is finished. The snaplen controls memory usage and processing load, while promiscuous mode may be unsupported or restricted by hardware or drivers. The to_ms timeout affects responsiveness and how pcap_loop or pcap_dispatch deliver packets. Opening a live capture typically requires appropriate privileges (for example, root or administrator rights on many systems). After opening, users may apply a filter with pcap_compile and pcap_setfilter to limit captured traffic.

See also: other libpcap functions for offline captures and filter management, such as pcap_open_offline, pcap_open_dead, pcap_loop, and pcap_setfilter.