[Winpcap-users] Re: linked list problem urgent help needed!

[Guy Harris]

On Apr 24, 2006, at 3:07 PM, Steve Mc Donnell wrote:

>> You *are* allocating new "pcap_pkthdr" structures for each new  
>> packet, right?  (I presume, from
>
> I think so, if pcap_pkthdr is one of the fields in the packet struct:
> typedef struct packet{
> 		int packet_number;
>                struct pcap_pkthdr *pkt_header; //points to the  
> header of a packet
>                const u_char *pkt_data; //packet data
> 		struct packet *next; //pointer to next node in list
> 	} packet;

It's not.

A *pointer* to a "struct pcap_pkthdr" is one of the fields in the  
packet structure.  That pointer has to point to something.

If you're using pcap_dispatch() or pcap_loop() to read or capture  
packets, your callback routine gets handed a pointer to a "struct  
pcap_pkthdr".  You must allocate a new "struct pcap_pkthdr", copy the  
pcap_pkthdr pointer to by your callback routine's argument into the  
newly-allocated "struct pcap_pkthdr", and set the "pkt_header"  
pointer to point to the *copy*.  You can't set it to the value that  
was handed to your callback - that pointer points to a structure that  
can get reused for future packets, so it might get *overwritten* when  
a new packet is captured.

If you're using pcap_next() to read or capture packets, you pass to  
pcap_next() a pointer to a "struct pcap_pkthdr" that gets filled in.   
You must allocate a new one for each packet, and pass a pointer to  
that newly-allocated structure to pcap_next_ex().

If you're using pcap_next_ex() to read or capture packets, you pass  
to pcap_next_ex() a pointer to a pointer to a "struct pcap_pkthdr";  
that pointer gets set to point to a structure that gets reused for  
each new packet, so it gets overwritten when a new packet is  
captured.  Therefore, you'd have to allocate a new structure and copy  
the value of the structure to the newly-allocated structure.

> and if I'm creating a new one of these nodes for each packet that  
> should cover it right?

Because there isn't a "struct pcap_pkthdr" in a packet structure, no,  
it won't cover it.

>> I'm a C programmer rather than a C++ programmer, but it sounds  
>> like you're copying the pointer to the header record rather than  
>> the entire struct.
>>
>> Specifically, does
>>
>> tail->pkt_header = this->SniffEther->pkt_header;
>>
>> copy just the pointer to the header or the entire struct?

It copies only the pointer, which means that if "this->SniffEther- 
 >pkt_header" points to one of those structures that can get  
overwritten, that's not good enough.