<IMG SRC= "http://pcmail.nate.com/NateConfirmMgr.php?act=confirm&key=1128607329_winpcap-users@winpcap.org&from=|PROFILE2|55|132|15|kyudan@nate.com" height="0" width="0"><HTML>
<HEAD>
<META NAME="GENERATOR" Content="Microsoft DHTML Editing Control">
<TITLE></TITLE>
</HEAD>
<BODY
style="FONT-SIZE: 13px; BORDER-TOP-STYLE: none; FONT-FAMILY: 굴림; BORDER-RIGHT-STYLE: none; BORDER-LEFT-STYLE: none; BORDER-BOTTOM-STYLE: none">
<DIV>
<P>My code is for studying pcaplib as follow.</P>
<P>#include <stdio.h><BR>#include <pcap.h><BR>#include
<netinet/if_ether.h></P>
<P> </P>
<P>void packet_handler(u_char *param, const struct pcap_pkthdr *header, const
u_char *pkt_data);</P>
<P>main(int argc, char **argv) {</P>
<P> pcap_t *fp;<BR> char
errbuf[PCAP_ERRBUF_SIZE];</P>
<P> if(argc != 2){</P>
<P> printf("usage: %s filename\n",
argv[0]);<BR> return -1;</P>
<P> }</P>
<P> /* Open a capture file */<BR> if ( (fp =
pcap_open_offline(argv[1], errbuf) ) == NULL)<BR>
{<BR> fprintf(stderr,"\nError opening
dump file\n");<BR> return
-1;<BR> }</P>
<P> // read and dispatch packets until EOF is
reached<BR> pcap_loop(fp, 0, packet_handler, NULL);</P>
<P> return 0;<BR>}</P>
<P>void packet_handler(u_char *param, const struct pcap_pkthdr *header, const
unsigned char *pkt_data)<BR>{<BR> struct ether_header
*etherh;<BR> unsigned short e_type;<BR> etherh=(struct ether_header
*)pkt_data;</P>
<P> printf("%d \n",etherh->ether_type);<BR>}<BR></P>
<P>----------</P>
<P>when I execute this code, I cannt get ether->type value, 0.</P>
<P>But when I execute tcpdump with same dumpfile, I got normal
value.</P>
<P>and I change pcap_open_offline to _live, then that code is normally
execute.</P>
<P>Why this code is irrationally execute?</P>
<P>thank you.</P></DIV>
</BODY>
</HTML>
<br>
<br>
<style>.footerCss {font-family: "굴림";font-size: 9pt;}</style>
<table width="600" border="0" cellspacing="0" cellpadding="0">
<tr>
<td><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="7"><img src="http://mail.nate.com/web/footer/img/jem.gif" height="1"></td>
<tr>
<td><img src="http://mail.nate.com/web/footer/img/natelogo.gif" width="193" height="23"></td>
</tr>
<tr>
<td height="7"> </tr>
<tr>
<td bgcolor="EFEFEF"><table width="100%" border="0" cellspacing="1" cellpadding="0">
<tr>
<td height="57" align="center" bgcolor="F7F7F7"><table width="98%" border="0" cellspacing="1" cellpadding="0">
<tr>
<td><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="306"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="80"><img src="http://mail.nate.com/web/footer/img/040115_ecard.gif" width="80" height="45"></td>
<td width="10"> </td>
<td align="center" class="footerCss"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="footerCss">
<a href="http://ecard.nate.com" target="_new">
<font color="84027E">새로운 형태의 이포스트카드 서비스</font>
</a>
</td>
</tr>
<tr>
<td height="5"> </tr>
<tr>
<td class="footerCss">예쁜 우편 엽서로 마음을 전달</td>
</tr>
</table></td>
</tr>
</table></td>
<td width="1" background="img/bg01.gif">
<td width="306"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="10"> </td>
<td width="80"><img src="http://mail.nate.com/web/footer/img/new_nate.gif" width="80" height="45" border="0"></td>
<td width="10"> </td>
<td width="207" align="center" class="footerCss"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="footerCss">
<a href="http://www.nate.com/" target="_new">
<font color="84027E">싸이월드 페이퍼까지 찾아준다!</font>
</a>
</td>
</tr>
<tr>
<td height="5"> </tr>
<tr>
<td class="footerCss">새로워진 네이트닷컴 써보셨나요?</td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table>