# using libpcap with timeout

**URL:** <https://community.unix.com/t/using-libpcap-with-timeout/280252>\
**Category:** Programming\
**Created:** [January 5, 2011, 2:35pm UTC](https://community.unix.com/t/using-libpcap-with-timeout/280252 "2011-01-05T14:35:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![xyzt](https://community.unix.com/letter_avatar/xyzt/32/6_22734026db12803ebb3e059622ac3534.png) [@xyzt](https://community.unix.com/u/xyzt)\
**Post date:** [January 5, 2011, 2:35pm UTC](https://community.unix.com/t/using-libpcap-with-timeout/280252/1 "2011-01-05T14:35:08Z")

</div>

I want to write a small application using Libpcap in C on Linux.

Currently, it starts to sniff and waits for the packets. But that's not what I need actually. I want it to wait for N seconds and then stop listening. (I think there's something wrong with my usage of 'pcap\_open\_live'...)

How can I achieve that?

Here's my code:

```nohighlight
void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet)
{
       printf("got packet\n);
}

int main()
{
 int ret = 0;
 char *dev = NULL; /* capture device name */
 char errbuf[PCAP_ERRBUF_SIZE]; /* error buffer */
 pcap_t *handle; /* packet capture handle */

 char filter_exp[] = "udp dst port 1500"; /* filter expression */
 struct bpf_program fp; /* compiled filter program (expression) */
 bpf_u_int32 mask; /* subnet mask */
 bpf_u_int32 net; /* ip */
 int num_packets = 10; /* number of packets to capture */

 /* get network number and mask associated with capture device */
 if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
  fprintf(stderr, "Couldn't get netmask for device %s: %s\n",
      dev, errbuf);
  net = 0;
  mask = 0;
 }

 /* print capture info */
 printf("Device: %s\n", dev);
 printf("Number of packets: %d\n", num_packets);
 printf("Filter expression: %s\n", filter_exp);

 /* open capture device */
 handle = pcap_open_live(dev, SNAP_LEN, 1, 1000, errbuf);
 if (handle == NULL) {
  fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
  exit(EXIT_FAILURE);
 }

 /* compile the filter expression */
 if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
  fprintf(stderr, "Couldn't parse filter %s: %s\n",
      filter_exp, pcap_geterr(handle));
  exit(EXIT_FAILURE);
 }

 /* apply the compiled filter */
 if (pcap_setfilter(handle, &fp) == -1) {
  fprintf(stderr, "Couldn't install filter %s: %s\n",
      filter_exp, pcap_geterr(handle));
  exit(EXIT_FAILURE);
 }

 /* now we can set our callback function */
 pcap_loop(handle, num_packets, got_packet, NULL);

 /* cleanup */
 pcap_freecode(&fp);
 pcap_close(handle);
}

```

Man page says:

```
   pcap_t *pcap\_open_live\(const char *device, int snaplen,
           int promisc, int to_ms, char *errbuf\);

```

DESCRIPTION  
pcap\_open\_live() is used to obtain a packet capture handle to look at packets on the network. device is a string that specifies the network device to open; on Linux systems with 2.2  
or later kernels, a device argument of "any" or NULL can be used to capture packets from all interfaces.

```
   snaplen specifies the snapshot length to be set on the handle.

   promisc specifies if the interface is to be put into promiscuous mode.

   to_ms specifies the read timeout in milliseconds.
```