title: Will pcap_set_filter() work with pcap_open_offline()?
body: <p>I'm have written a <code>pcap</code> program that uses <code>pcap_open_live()</code> and progressively applies a filter (ie. recompiles the <code>pcap</code> filter and sets the filter again after an initial pcap_loop), and I would like to test it on some <code>pcap</code> files I have saved from <code>Wireshark</code>.</p>
  
  <p>However, when I run the program, I can't even print out my packets unless I supply an empty filter to the <code>pcap_compile_filter</code>;</p>
  
  <p>Is this just a feature of using <code>lpcap</code> on a saved file, or am I doing something wrong?</p>
  
  <p>Here's a snippet of the code for perusal:</p>
  
  <pre><code>int main(int argc, char **argv)
  {
  char *dev = NULL;           /* capture device name */
  char errbuf[PCAP_ERRBUF_SIZE];      /* error buffer */
  pcap_t *handle;             /* packet capture handle */
  char filter_exp[] = "ip";           /* filter expression [3] */
  struct bpf_program fp;          /* compiled filter program (expression) */
  bpf_u_int32 mask;           /* subnet mask */
  bpf_u_int32 net;            /* ip */
  int num_packets = -1;           /* number of packets to capture  -1 =&gt; capture forever! */
  
  printf("Filter expression: %s\n", filter_exp);
  
  // open capture device
  handle = pcap_open_offline("heartbeats2", errbuf);
  if (handle == NULL) {
      fprintf(stderr, "pcap_open_offline failed: %s\n", errbuf);
      exit(EXIT_FAILURE);
  }
  
  /* make sure we're capturing on an Ethernet device*/
  if (pcap_datalink(handle) != DLT_EN10MB) {
      fprintf(stderr, "%s is not an Ethernet\n", dev);
      exit(EXIT_FAILURE);
  }
  
  /* compile the filter expression */
  if (pcap_compile(handle, &amp;fp, filter_exp, 0, 0) == -1) {
      fprintf(stderr, "Couldn't parse filter %s: %s\n",
          filter_exp, pcap_geterr(handle));
      exit(EXIT_FAILURE);
  }
  
  /* apply the compiled filter */
  if (pcap_setfilter(handle, &amp;fp) == -1) {
      fprintf(stderr, "Couldn't install filter %s: %s\n",
          filter_exp, pcap_geterr(handle));
      exit(EXIT_FAILURE);
  }
  
  pcap_loop(handle, -1, gotPacket, NULL);
  
  pcap_freecode(&amp;fp);
  pcap_close(handle);
  
  printf("\nCapture complete.\n");
  
  return(0);
  }
  </code></pre>
  
  <p>The got packet function just prints out the payload of the packet;  The output is just:</p>
  
  <pre><code>Filter expression: ip
  
  Capture complete.
  </code></pre>