[Winpcap-users] pcap_next_ex is notupdatingthepointertopcap_pkthdr structure

[Renato Araújo Ferreira]

OK, GV!! You were right (as usually)....

Now I´m copying all the data:


  objPacket = new Packet();
  objPacket->Timestamp.tv_sec = Header->ts.tv_sec;
  objPacket->Timestamp.tv_usec = Header->ts.tv_usec;
  objPacket->Length = Header->len;
  objPacket->Data = (u_char*) malloc(objPacket->Length);
  memcpy_s((void*)objPacket->Data,objPacket->Length,Data,objPacket->Length);
  objCapturer->add(objPacket);


Is there any problem yet?


Thanks,

Renato...

  ----- Original Message ----- 
  From: Renato Araújo Ferreira 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, November 07, 2007 11:19 PM
  Subject: Re: [Winpcap-users] pcap_next_ex is notupdatingthepointertopcap_pkthdr structure


  GV,

  I already changed the code.


  Before:

  =================================================================================
   struct Packet
   {
    struct pcap_pkthdr* Header;
    const u_char* Data;
   };

   ...

   while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
   {
     ...
   
    objPacket = new Packet();
    objPacket->Header = Header;
    objPacket->Data = Data;
    objCapturer->add(objPacket);
    
    ...
   }
  =================================================================================


  Now:

  =================================================================================
   struct Packet
   {
    struct timeval Timestamp;
    bpf_u_int32 Length;
    const u_char* Data;
   };

    ...

   while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
   {
     ...
   
    objPacket = new Packet();
    objPacket->Timestamp.tv_sec = Header->ts.tv_sec;
    objPacket->Timestamp.tv_usec = Header->ts.tv_usec;
    objPacket->Length = Header->len;
    objPacket->Data = Data;
    objCapturer->add(objPacket);
    
    ...
   }
  =================================================================================
   

  Now all appear to be working properly.


  Are you sure about copying the data array too? This array aren´t malloc'ed again in each call of pcap_next_ex()? I think so, because their address are always changing.


  Thanks,

  Renato...

    ----- Original Message ----- 
    From: Gianluca Varenni 
    To: winpcap-users at winpcap.org 
    Sent: Wednesday, November 07, 2007 10:36 PM
    Subject: Re: [Winpcap-users] pcap_next_ex is not updatingthepointertopcap_pkthdr structure


    Yes, you definitely need to copy both the packet and the header returned by pcap_next_ex(). The header and the data pointer returned by pcap_next_ex() are valid up to the next call to pcap_next_ex() or pcap_close(), whatever comes first.

    Have a nice day
    GV

      ----- Original Message ----- 
      From: Renato Araújo Ferreira 
      To: winpcap-users at winpcap.org 
      Sent: Wednesday, November 07, 2007 4:14 PM
      Subject: Re: [Winpcap-users] pcap_next_ex is not updating thepointertopcap_pkthdr structure


      GV,

      It's the problem. I'm using a thread that put each packet in a queue while another thread process their data.

      So I think that I need to copy the content of 'len' and 'ts' members before putting in the queue, instead of using the 'header' structure directly.

      Thanks,

      Renato.

        ----- Original Message ----- 
        From: Gianluca Varenni 
        To: winpcap-users at winpcap.org 
        Sent: Wednesday, November 07, 2007 2:14 PM
        Subject: Re: [Winpcap-users] pcap_next_ex is not updating the pointertopcap_pkthdr structure


        This is normal. pcap_next_ex() reuses an internal field of the pcap_t handle to return Header. And this gets rewritten for every packet.

        Which specific adapter are you capturing from?

        Have a nice day
        GV
          ----- Original Message ----- 
          From: Renato Araújo Ferreira 
          To: winpcap-users at winpcap.org 
          Sent: Tuesday, November 06, 2007 9:01 PM
          Subject: [Winpcap-users] pcap_next_ex is not updating the pointer topcap_pkthdr structure


          Hello,

          Im using 'pcap_next_ex()' to receive the packets in a loop, but i found a problem. A lot of packets appeared to be the same length and timestamp, but Im sure that that value was wrong, confirmed in wireshark (great tool).

          Looking for a solution, I found this strange behavior:

            struct pcap_pkthdr* Header;
            const u_char* Data;
            while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
            
          In the code above, I can see in the debug mode that 'Data' pointer address are updated all the time, while 'Header' return a repeated address value many times. 'Header' pointer are updated only some times.

          Could someone help me?
           
          thanks,
           
          Renato....



----------------------------------------------------------------------


          _______________________________________________
          Winpcap-users mailing list
          Winpcap-users at winpcap.org
          https://www.winpcap.org/mailman/listinfo/winpcap-users



------------------------------------------------------------------------


        _______________________________________________
        Winpcap-users mailing list
        Winpcap-users at winpcap.org
        https://www.winpcap.org/mailman/listinfo/winpcap-users



--------------------------------------------------------------------------


      _______________________________________________
      Winpcap-users mailing list
      Winpcap-users at winpcap.org
      https://www.winpcap.org/mailman/listinfo/winpcap-users



----------------------------------------------------------------------------


    _______________________________________________
    Winpcap-users mailing list
    Winpcap-users at winpcap.org
    https://www.winpcap.org/mailman/listinfo/winpcap-users



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071108/a9408258/attachment.htm