On Mar 21, 2007, at 6:07 PM, Greg Hellings wrote:
In my experience libpcap lacks an application-layer parser.
Correct. Parsing the packet at all is left up to the program using libpcap or the library processing the packets that libpcap generates, as different applications have different requirements (tcpdump parses the packets and prints out some dissection, Wireshark parses the packets in great detail and generates a tree, other programs might calculate statistics or look for malicious packets or...).
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
