pcap_setfilter(3) pcap_setfilter(3)
NAME
pcap_setfilter - set the filter
SYNOPSIS
#include <pcap/pcap.h>
pcap_setfilter(3) *p, struct bpf_program *fp);
DESCRIPTION
pcap_setfilter() is used to specify a filter program. fp is a pointer
to a bpf_program structure, usually the result of a call to
pcap_compile(3). The structure members have the same meaning as in
pcap_offline_filter(3), except in pcap_setfilter() fp.bf_insns must
be a non-null pointer. In other words, any successful result of
pcap_compile() is always valid in pcap_setfilter().
If the calls to pcap_compile() and pcap_setfilter() use the same pcap_t
handle, packet filtering should either work correctly or fail correctly
without additional efforts. Otherwise the filter program must have
been compiled for the same link-layer header type as the one used by
the pcap_t handle, also on Linux any usage of BPF extensions must match
the use case. Specifically, if the pcap_t stands for an input
savefile, the filter program must not use the extensions, but if it
stands for a live packet capture, the filter program may use the
extensions if necessary. See pcap_compile() for more information.
RETURN VALUE
pcap_setfilter() returns 0 on success, PCAP_ERROR_NOT_ACTIVATED if
called on a capture handle that has been created but not activated, or
PCAP_ERROR on other errors. If PCAP_ERROR is returned,
pcap_geterr(3) or pcap_perror(3) may be called with p as an
argument to fetch or display the error text.
SEE ALSO
pcap(3)
11 September 2026 pcap_setfilter(3)
libpcap 1.11.0 - Generated Tue Sep 15 09:19:30 CDT 2026