To create a pcap
file, you need to get pcap_t*
and pcap_dumper_t*
pointers first:
......
pcap_t *dst_handle = pcap_open_dead(DLT_EN10MB, 262144);
pcap_dumper_t *dst_dump = pcap_dump_open(dst_handle, "output.pcap");
......
In fact, the pcap_t*
is only used for pcap_dump_open()
, i.e., create pcap
file header; the following operations, such as pcap_dump()
, won’t use it. It means if pcap_dump_open()
succeeds, the pcap_t*
can be closed right away:
......
pcap_t *dst_handle = pcap_open_dead(DLT_EN10MB, 262144);
pcap_dumper_t *dst_dump = pcap_dump_open(dst_handle, "output.pcap");
if (dst_dump == NULL) {
printf("pcap_dump_open error: %s\n", pcap_geterr(dst_handle));
pcap_close(dst_handle);
return EXIT_FAILURE;
}
pcap_close(dst_handle);
......
The same applies for pcap_dump_fopen()
.
Thank you. This is useful info.