pcap_dump() is described in pcap.3 as follows:
pcap_dump() outputs a packet to the savefile opened with pcap_dump_open().
Note that its calling arguments are suitable for use with pcap_dispatch().
That formulation is imho not entirely clear,
as the arguments mention no "savefile".
(Looking at the source, it just treats the 'user' argument as a FILE*
which is what a pcap_dumper_t* returned by pcap_dump_open() really is,
and fwrite()s the header and packet data there.)
It would be clearer if the manpage said that the 'user' is the savefile,
and that it is to be passed as the last argument to pcap_dispatch()
when using pcap_dump() as a callback function.
Jan
Index: pcap.3
===================================================================
RCS file: /cvs/src/lib/libpcap/pcap.3,v
retrieving revision 1.48
diff -u -p -r1.48 pcap.3
--- pcap.3 3 Jun 2018 10:45:15 -0000 1.48
+++ pcap.3 10 Dec 2018 07:01:13 -0000
@@ -353,9 +353,17 @@ or
may be used to display the error text.
.Pp
.Fn pcap_dump
-outputs a packet to the savefile opened with
-.Fn pcap_dump_open .
-Note that its calling arguments are suitable for use with
+outputs a packet to a previously opened savefile,
+if the pointer obtained with
+.Fn pcap_dump_open
+is passed as the
+.Fa user
+argument.
+This makes
+.Fn pcap_dump
+a suitable
+.Fa callback
+to use with
.Fn pcap_dispatch .
.Pp
.Fn pcap_inject
