[Winpcap-users] How to receive extended statistics from pcap_stats_ex

[Mark Bednarczyk]

Hi I'm writting a java wrapper around WinPcap
(http://sf.net/projects/jnetpcap) and I'm having a little difficulty
understanding the API call to pcap_stats_ex, the structure it actually uses
and when the extended statistics are available.
 
The documentation say that it returns a "pcap_stat" structure, but that
structure is only for backward compatibility. When I dig into the header
file "pcap.h" I can see the following  definition:
 
struct pcap_stat {
	u_int ps_recv;		/* number of packets received */
	u_int ps_drop;		/* number of packets dropped */
	u_int ps_ifdrop;	/* drops by interface XXX not yet supported
*/
#ifdef HAVE_REMOTE
	u_int ps_capt;		/* number of packets that are received by
the application; please get rid off the Win32 ifdef */
	u_int ps_sent;		/* number of packets sent by the server on
the network */
	u_int ps_netdrop;	/* number of packets lost on the network */
#endif /* HAVE_REMOTE */
};

But there is also a very lengthy pcap_stat_ex definition with 24 fields in
it:

#ifdef MSDOS
/*
 * As returned by the pcap_stats_ex()
 */
struct pcap_stat_ex {
       u_long  rx_packets;        /* total packets received       */
       u_long  tx_packets;        /* total packets transmitted    */
       u_long  rx_bytes;          /* total bytes received         */
       u_long  tx_bytes;          /* total bytes transmitted      */
       u_long  rx_errors;         /* bad packets received         */
... [truncated]
}
#endif

I really need to understand this thoroughly before I can put this call into
my java API. Can someone explain to me when the extended information becomes
available and if there is a different structure super imposed on pcap_stat. 

The pcap_stat_ex does not match the fields of first 3 in pcap_stat, and the
#ifdef MSDOS around, suggests to me that is an older structure used for
MSDOS systems and possibly deprecated. 

My tests also show that 24 bytes of data are returned from pcap_stat_ex, so
that could mean 3 of the 8-byte longs in the pcap_stat_ex or all 6 4-byte
integers in pcap_stat. 

Thanks in advance.

Cheers,
mark..
http://jnetpcap.sf.net