<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>GV,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I already changed the code.</FONT></DIV>
<DIV> </DIV><FONT face=Arial size=2>
<DIV><BR>Before:</DIV>
<DIV> </DIV>
<DIV>=================================================================================<BR> struct
Packet<BR> {<BR> struct pcap_pkthdr*
Header;<BR> const u_char* Data;<BR> };</DIV>
<DIV> </DIV>
<DIV> ...</DIV>
<DIV> </DIV>
<DIV> while( (Results = pcap_next_ex( PcapHandler, &Header, &Data))
>= 0 )<BR> {<BR> ...<BR> <BR> objPacket =
new Packet();<BR> objPacket->Header =
Header;<BR> objPacket->Data =
Data;<BR> objCapturer->add(objPacket);<BR> <BR> ...<BR> }<BR>=================================================================================</DIV>
<DIV> </DIV>
<DIV><BR>Now:</DIV>
<DIV> </DIV>
<DIV>=================================================================================<BR> struct
Packet<BR> {<BR> struct timeval
Timestamp;<BR> bpf_u_int32 Length;<BR> const u_char*
Data;<BR> };</DIV>
<DIV> </DIV>
<DIV> ...</DIV>
<DIV> </DIV>
<DIV> while( (Results = pcap_next_ex( PcapHandler, &Header, &Data))
>= 0 )<BR> {<BR> ...<BR> <BR> objPacket =
new Packet();<BR> objPacket->Timestamp.tv_sec =
Header->ts.tv_sec;<BR> objPacket->Timestamp.tv_usec =
Header->ts.tv_usec;<BR> objPacket->Length =
Header->len;<BR> objPacket->Data =
Data;<BR> objCapturer->add(objPacket);<BR> <BR> ...<BR> }<BR>=================================================================================<BR> </DIV>
<DIV> </DIV>
<DIV>Now all appear to be working properly.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Are you sure about copying the data array too? This array aren´t malloc'ed
again in each call of pcap_next_ex()? I think so, because their address are
always changing.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Thanks,</DIV>
<DIV> </DIV>
<DIV>Renato...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=gianluca.varenni@cacetech.com
href="mailto:gianluca.varenni@cacetech.com">Gianluca Varenni</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007 10:36
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] pcap_next_ex
is not updatingthepointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT size=2>Yes, you definitely need to copy both the packet and the
header returned by pcap_next_ex(). The header and the data pointer returned by
pcap_next_ex() are valid up to the next call to pcap_next_ex() or
pcap_close(), whatever comes first.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007 4:14
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users]
pcap_next_ex is not updating thepointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>GV,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>It's the problem. I'm using a thread that put
each packet in a queue while another thread process their data.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>So I think that I need to copy the content
of 'len' and 'ts' members before putting in the queue, instead of using the
'header' structure directly.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Renato.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=gianluca.varenni@cacetech.com
href="mailto:gianluca.varenni@cacetech.com">Gianluca Varenni</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007
2:14 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users]
pcap_next_ex is not updating the pointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT size=2>This is normal. pcap_next_ex() reuses an internal
field of the pcap_t handle to return Header. And this gets rewritten for
every packet.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Which specific adapter are you capturing
from?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, November 06, 2007
9:01 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users]
pcap_next_ex is not updating the pointer topcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>Hello,</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Im using 'pcap_next_ex()' to receive the
packets in a loop, but i found a problem. A lot of packets appeared to
be the same length and timestamp, but Im sure that that value was wrong,
confirmed in wireshark (great tool).</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Looking for a solution, I found this
strange behavior:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2> struct pcap_pkthdr*
Header;<BR> const u_char* Data;<BR> while( (Results =
pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )<BR>
<BR>In the code above, I can see in the debug mode that 'Data' pointer
address are updated all the time, while 'Header' return a repeated
address value many times. 'Header' pointer are updated only some
times.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Could someone help
me?<BR> <BR>thanks,<BR> <BR>Renato....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>