title: pcap_compile() expression
body: <p>I am writing a pcaket sniffer program using libpcap library on the "wlan" interface. I wanted to filter captured packets so that only Beacon frames would be processed. So, I wrote the following code for that: <br /></p>
  
  <pre><code>const char *str = "wlan subtype beacon";
  printf("debug stmt1\n");
  
  struct bpf_program *fp;
  printf("debug stmt2\n");
  
  if((pcap_compile(pkt_handle, fp, str, 1, PCAP_NETMASK_UNKNOWN)==-1)
  {
      pcap_perror(pkt_handle, "Compile");
  }
  printf("debug stmt3\n"):
  </code></pre>
  
  <p>But on compiling, I get a segmentation fault on the pcap_compile() statement:</p>
  
  <pre><code>debug stmt1
  debug stmt2
  Segmentation fault
  </code></pre>
  
  <p>So, what could be the problem?</p>
  
  <p>Opearting System: Ubuntu 10.10</p>
  
  <p><strong>Update:</strong> <br />
  <br />
  I moved pcap_compile() statement before pcap_activate() statement. The program works fine and captures only Beacon frames. But, still pcap_compile() seems to be returning -1 and I get the following statement in the output:</p>
  
  <pre><code>Compile: 802.11 link-layer types supported only on 802.11
  </code></pre>
  
  <p>What could be the problem? I am using Netgear USB wireless card.
  <br />
  <strong>Update2:</strong></p>
  
  <p>As suggested by nos, I made the following change:</p>
  
  <pre><code>struct bpf_program *fp = (struct bpf_program *)malloc(sizeof(struct bpf_program));
  </code></pre>
  
  <p>But, still I am getting the same message:</p>
  
  <pre><code>Compile: 802.11 link-layer types supported only on 802.11
  </code></pre>
  
  <p>Any idea what does that message mean?
  <br />
  <br />
  <strong>Update 3:</strong>
  <br />
  I also included the following code to make sure that my pcap handle is pointing to the correct interface: <br /></p>
  
  <pre><code>int *dlt_buf;
  int n;
  n = pcap_list_datalinks(pkt_handle, &amp;dlt_buf);
  printf("n = %d\n",n);
  if(n == -1)
  {
      pcap_perror(pkt_handle, "Datalink_list");
  }
  else
  {
      printf("The list of datalinks supported are\n");
      int i;
      for(i=0; i&lt;n; i++)
          printf("%d\n",dlt_buf[i]);
      const char *str1 = pcap_datalink_val_to_name(dlt_buf[0]);
      const char *str2 = pcap_datalink_val_to_description(dlt_buf[0]);
      printf("str1 = %s\n",str1);
      printf("str2 = %s\n",str2);
      pcap_free_datalinks(dlt_buf);
  }
  </code></pre>
  
  <p><br />
  This is the output I got:</p>
  
  <pre><code>n = 1
  The list of datalinks supported are
  127
  str1 = IEEE802_11_RADIO
  str2 = 802.11 plus radiotap header
  </code></pre>
  
  <p><br /></p>
  
  <p>So, my pcap handle is pointing to the correct interface. But still I am getting that error message.</p>