[Winpcap-users] Finding header size.

[Gianluca Varenni]

----- Original Message ----- 
From: "Ramiro Polla" <ramiro86 at hotmail.com>
To: <winpcap-users at winpcap.org>
Sent: Friday, March 17, 2006 6:24 AM
Subject: [Winpcap-users] Finding header size.


> Hello,
>
> Is there a way for winpcap to inform me the size of the ethernet (or 
> whatever) header? Do I really have to check pcap_datalink(pd) myself?

Uhm, what do you mean? pcap_datalink tells you the datalink of the packets, 
so if it's ethernet or not (not "the size of ethernet header", which is 
always 14 bytes).

So, yes, you need to call pcap_datalink after having opened an adapter and, 
given the datalink of the adapter, decide how to dissect packets (so if the 
first header is Ethernet vs. token ring vs. ???).


> I was wondering, since winpcap can tell me if it's an ip address or not, 
> it must know the header size before the ip address.

No, it doesn't. WinPcap basically obtains the IP address(es) of an adapter 
usually querying the registry or the IP helper API on the basis of the 
adapter GUID. In other words, it does not sniff packets in order to obtain 
the IP address(es) of an adapter.

Hope it helps
GV

>
> Thanks,
> Bye,
> Ramiro Polla _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>