[Winpcap-users] pcap_next_ex is not updating thepointertopcap_pkthdr structure

[Gianluca Varenni]

Yes, you definitely need to copy both the packet and the header returned by pcap_next_ex(). The header and the data pointer returned by pcap_next_ex() are valid up to the next call to pcap_next_ex() or pcap_close(), whatever comes first.

Have a nice day
GV

  ----- Original Message ----- 
  From: Renato Araújo Ferreira 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, November 07, 2007 4:14 PM
  Subject: Re: [Winpcap-users] pcap_next_ex is not updating thepointertopcap_pkthdr structure


  GV,

  It's the problem. I'm using a thread that put each packet in a queue while another thread process their data.

  So I think that I need to copy the content of 'len' and 'ts' members before putting in the queue, instead of using the 'header' structure directly.

  Thanks,

  Renato.

    ----- Original Message ----- 
    From: Gianluca Varenni 
    To: winpcap-users at winpcap.org 
    Sent: Wednesday, November 07, 2007 2:14 PM
    Subject: Re: [Winpcap-users] pcap_next_ex is not updating the pointertopcap_pkthdr structure


    This is normal. pcap_next_ex() reuses an internal field of the pcap_t handle to return Header. And this gets rewritten for every packet.

    Which specific adapter are you capturing from?

    Have a nice day
    GV
      ----- Original Message ----- 
      From: Renato Araújo Ferreira 
      To: winpcap-users at winpcap.org 
      Sent: Tuesday, November 06, 2007 9:01 PM
      Subject: [Winpcap-users] pcap_next_ex is not updating the pointer topcap_pkthdr structure


      Hello,

      Im using 'pcap_next_ex()' to receive the packets in a loop, but i found a problem. A lot of packets appeared to be the same length and timestamp, but Im sure that that value was wrong, confirmed in wireshark (great tool).

      Looking for a solution, I found this strange behavior:

        struct pcap_pkthdr* Header;
        const u_char* Data;
        while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
        
      In the code above, I can see in the debug mode that 'Data' pointer address are updated all the time, while 'Header' return a repeated address value many times. 'Header' pointer are updated only some times.

      Could someone help me?
       
      thanks,
       
      Renato....



--------------------------------------------------------------------------


      _______________________________________________
      Winpcap-users mailing list
      Winpcap-users at winpcap.org
      https://www.winpcap.org/mailman/listinfo/winpcap-users



----------------------------------------------------------------------------


    _______________________________________________
    Winpcap-users mailing list
    Winpcap-users at winpcap.org
    https://www.winpcap.org/mailman/listinfo/winpcap-users



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071108/4acddff4/attachment.htm