[Winpcap-users] What do the expressions guarantee to me?

[Guy Harris]

Ramiro Polla wrote:

> Just another question though. Am I guaranteed to contain at least a 
> complete IP and/or TCP/UDP header?,

No.  The packet might either be a bad packet (one that's perhaps 
deliberately too short - don't trust whatever's sending the packets 
you're capturing to send only valid packets!), or, if you set a snapshot 
length < the size of the link-layer+IP header, it might be cut short by 
the snapshot length.

> or just as far as the ip_p value? Do 
> I have to check if the data is at least as long as sizeof(ip_header)?

Yes.