# pcap_compile

## NAME



           pcap_compile - compile a filter expression
    


## SYNOPSIS



           **#include <pcap/pcap.h>**
    
           **int pcap_compile(pcap_t *p, struct bpf_program *fp,**
               **const char *str, int optimize, bpf_u_int32 netmask);**
    


## DESCRIPTION



           **pcap_compile**() is used to compile the string _str_ into a filter
           program.  See pcap-filter(7) for the syntax of that string.  _fp_ is
           a pointer to a _bpf_program_ struct and is filled in by
           **pcap_compile**().  _optimize_ controls whether optimization on the
           resulting code is performed.  _netmask_ specifies the IPv4 netmask
           (in host byte order) of the network on which packets are being
           captured; it is used only when checking for IPv4 broadcast
           addresses in the filter program.  If the netmask of the network on
           which packets are being captured isn't known to the program, or if
           the network interface does not have exactly one IPv4 netmask, or
           if packets are being captured on the Linux "any" pseudo-interface,
           which can capture on more than one network interface, a value of
           **PCAP_NETMASK_UNKNOWN** can be supplied; in this case an attempt to
           compile a filter expression that contains the **ip broadcast**
           primitive will fail.
    
           On Linux, if the **pcap_t** handle corresponds to a live packet
           capture, the resulting filter program may use Linux BPF
           extensions.  This works transparently if the filter program is
           used to filter packets on the same **pcap_t** handle, which should be
           done when possible.  In other use cases trying to use a filter
           program with BPF extensions in **pcap_offline_filter**(3PCAP) or for
           filtering an input savefile would reject more packets than
           expected because the extensions depend on auxiliary packet data,
           which would not be available.  The workaround is to compile the
           filter without the extensions by using a **pcap_t** handle from
           **pcap_open_dead**(3PCAP) or **pcap_open_offline**(3PCAP) rather than a
           handle from **pcap_create**(3PCAP) or **pcap_open_live**(3PCAP).
    
           If BPF extensions are disabled as described above or the OS is not
           Linux, **pcap_compile**() may start rejecting some filter expressions
           for some link-layer header types, this is the expected behaviour.
           For example, the **ifindex** keyword is valid for any live capture on
           Linux, but when reading packets from a savefile, regardless of the
           OS it is valid for **DLT_LINUX_SLL2** only.
    


## RETURN VALUE



           **pcap_compile**() returns **0** on success and **PCAP_ERROR** on failure. If
           **PCAP_ERROR** is returned, **pcap_geterr**(3PCAP) or **pcap_perror**(3PCAP)
           may be called with _p_ as an argument to fetch or display the error
           text.
    


## BACKWARD COMPATIBILITY



           The **PCAP_NETMASK_UNKNOWN** constant became available in libpcap
           release 1.1.0.
    
           In libpcap 1.8.0 and later, **pcap_compile**() can be used in multiple
           threads within a single process.  However, in earlier versions of
           libpcap, it is _not_ safe to use **pcap_compile**() in multiple threads
           in a single process without some form of mutual exclusion allowing
           only one thread to call it at any given time.
    


* * *