[Winpcap-users] Can I save packets using pcap_next_ex

[Guy Harris]

Ziara . wrote:
> Hello, can someone tell me if I can save packets in a dump files using 
> pcap_next_ex instead of pcap_loop?

Yes.

> and How?

		...

	p = pcap_open_live(device, snaplen, promisc, timeout, errbuf);
	if (p == NULL) {
		fprintf("Couldn't open %s for capturing: %s\n",
		    device, errbuf);
		return 2;
	}
	d = pcap_dump_open(p, dump_file_name);
	if (d == NULL) {
		fprintf("Couldn't open %s as a save file: %s\n",
		    dump_file_name, pcap_strerror(errno));
		return 2;
	}

	for (;;) {
		status = pcap_next_ex(p, &hdr, &data);
		if (status == -1) {
			fprintf(stderr, "Couldn't read packet: %s\n",
			    pcap_geterr(p));
			break;
		}
		if (status == 1)
			pcap_dump((u_char *)d, hdr, data);
	}

		...