When I use pcap_next_ex like this: struct pcap_pkthdr *pkthdr; ... pcap_next_ex(p, &pkthdr, &pktp);
The returned pkthdr is invalid ! After do some trick like this: struct a4_pcap_pkthdr { u_int32_t tv_sec; u_int32_t tv_usec; u_int32_t caplen; /* length of portion present */ u_int32_t len; /* length this packet (off wire) */ } __attribute__ ((aligned (4))); ... struct pcap_pkthdr *pkthdr; struct a4_pcap_pkthdr *pkthdr2; ... pcap_next_ex(p, &pkthdr, &pktp); pkthdr2 = (struct a4_pcap_pkthdr *) pkthdr; The returned pkthdr2 is OK. What's the correct usage ? Thanks, Dongsheng Song