pcap_live
*bpfd = pcap_live(device, snaplen, promisc, dlt, dirfilt, fildrop);
int pcap_live(const char *, int, int, u_int, u_int, u_int);