On Mar 17, 2010, at 10:54 AM, Jim Lloyd wrote: > So, what does an error code of -3 indicate?
#define PCAP_ERROR_NOT_ACTIVATED -3 /* the capture needs to be activated */ > I've done some experimentation and determined that apparently I must call > pcap_activate before calling pcap_setfilter. Yes. > That is counter intuitive, so I wonder if it is by design or not. It may change at some point. It is, however, currently a requirement (on all platforms). It is also a requirement that the pcap_t be activated before you call pcap_compile(); lifting *that* restriction would require that we be able to get the link-layer type for the device before activating it, which may or may not be easy to do. I will update the documentation to indicate that the operations in question (pcap_datalink(), pcap_compile(), pcap_setfilter()) require that the pcap_t be activated *and* make what code changes are necessary to arrange that they fail on un-activated pcap_t's.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.