[Winpcap-users] linked list problem urgent help needed!

[Steve Mc Donnell]

I'm having a serious problem using a linked list at the moment. I'm using 
Visual C++ .NET 2003. When a packet is captured it is added to a linked 
list, the structure for this is:
typedef struct packet{
		int packet_number;
                struct pcap_pkthdr *pkt_header; //points to the header of a 
packet
                const u_char *pkt_data; //packet data
		struct packet *next; //pointer to next node in list
	} packet;

the original pkt_header and pkt_data retrieved are part of a class, and 
these get added to the linked list with this:

//below the packet is added to linked list
//done even if a real time update is checked
	if(head==NULL)
        {          //create the first node in the linked list
          head =new packet;
          tail=head;
          tail->next=NULL;
        }
        else
        {
          tail->next= new packet;
          tail=tail->next;
          tail->next=NULL;
        }
        tail->packet_number =packet_num++;         //add the packet to 
linked list
        tail->pkt_header = this->SniffEther->pkt_header;
        tail->pkt_data = this->SniffEther->pkt_data;


The data is eventually displayed in a listview control. This listview is 
filled with a function 'fillPacketList(const struct pcap_pkthdr 
*header,const u_char *pkt_data);' The user is given the option to update the 
gui in real time or it can be filled when the capture has taken place. When 
its updated in real time the packet header and data is taken directly from 
the originals and not from the linked list. To fill the listview after a 
capture, I loop through each packet in the linked list and pass it to the 
fillPacketList function with this code:

current = head;

while(current)
{
	fillPacketList(current->pkt_header,current->pkt_data);
	current=current->next;
}

When I update the list in real time everything is fine and displays the data 
correctly, but when I update the listview by using the above code the data 
from the header is the same for every single packet, they all have the exact 
same timestamp, length and time to live, yet data taken from pkt_data seems 
to be correct for each packet!! Saving packets with this:

while(current)
{
     pcap_dump((unsigned char *)dumpfile, current->pkt_header, 
current->pkt_data);
     current=current->next;

}

Shows the same behaviour when reopened, all packets act as if they have the 
same header >:(
Can anyone please help!!

_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee® 
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963