When I use pcap_next_ex like this:

   struct pcap_pkthdr *pkthdr;
   ...
   pcap_next_ex(p, &pkthdr, &pktp);

The returned pkthdr is invalid !  After do some trick like this:

   struct a4_pcap_pkthdr {
      u_int32_t       tv_sec;
      u_int32_t       tv_usec;
      u_int32_t caplen;     /* length of portion present */
      u_int32_t len;        /* length this packet (off wire) */
   } __attribute__ ((aligned (4)));

   ...
   struct pcap_pkthdr *pkthdr;
   struct a4_pcap_pkthdr *pkthdr2;
   ...
   pcap_next_ex(p, &pkthdr, &pktp);
   pkthdr2 = (struct a4_pcap_pkthdr *) pkthdr;

The returned pkthdr2 is OK. What's the correct usage ?

Thanks,

Dongsheng Song

Reply via email to