Steve Mc Donnell wrote: You *are* allocating new "pcap_pkthdr" structures for each new packet, right? (I presume, from > yet data taken > from pkt_data seems to be correct for each packet!! that you're allocating a new array of u_char for each new packet, and copying the packet data you get from WinPcap to that array.)