Thanks for the info.
I wanted some kind of indication about how full the buffer is. This is regarding the work i am doing with IDSs. So i was thinking it would be good - if the number of bytes in the buffer can be got also the number of packets..(not essential) I am using openbsd .. so in the pcap_read() in pcap-bpf.c there is no explicit setting of time. Is the time set by bpf ? i mean is it already in the bpf header ? thanks a lot ashley On Mon, 25 Mar 2002, Guy Harris wrote: > On Mon, Mar 25, 2002 at 06:46:15PM -0500, Ashley Thomas wrote: > > is it possible to write a function pcap_* for getting how many packets are > > currently in the buffer. > > It might be possibly to add to each of the "pcap-XXX.c" files routines > that would return that. > > It would not be possible to write a routine atop the existing libpcap > APIs to do that - the way you'd do that would be platform-independent. > > Why do you want that count? > > > where/when is the timestamp field set in the pcap-hdr ? > > It's set in "pcap_read()", which is an internal interface, and is > platform-dependent. > > Why do you ask? > - > This is the TCPDUMP workers list. It is archived at > http://www.tcpdump.org/lists/workers/index.html > To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe > - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
