[Winpcap-users] only when ethereal is ON

[Gianluca Varenni]

winpcap uses an internal buffer (within the pcap_t structure) where packets 
are stored. This buffer is reused throughout the capture process. So you 
might see the same pointer returned by pcap_next_ex over time. There's no 
sample that shows that, it's implementation specific inside the WinPcap 
library. What you need to know is that you do NOT need to release the 
pointers returned by pcap_next_ex. That's basically why packetdata[0][0] 
shows the same value for the first 4 packets (the internal buffer used by 
WinPcap holds several packets, not just one).

Let me know if this answers your question.

Have a nice day
GV

----- Original Message ----- 
From: "Umesh Chandra Sahoo" <USahoo at ixiacom.com>
To: <winpcap-users at winpcap.org>
Sent: Tuesday, July 08, 2008 7:26 AM
Subject: RE: [Winpcap-users] only when ethereal is ON


> Hi Gianluca
>
> I tried some experiment to validate your told things.
>
> In my module I inserted below lines for testing.
>
>
>
>
> unsigned char *packet_data[4];
> int ctr = 0;
> while(((res = pcap_next_ex( fp, &header, &packet_data[ctr])) >= 0) &
> (ctr < 4)){
> printf("\n\n @#@#@#@# [%d].Umesh DBG pkt_data_addr[%u] ,
> pkt_data_value[%c] \n", ctr, packet_data[0],
> packet_data[0][0]);
> ctr++;
> }
> pcap_close(fp);
> printf("\n\n AFTER PCAP CLOSE.Umesh DBG pkt_data_addr[%u],
> pkt_data_value[%c] \n",
>    packet_data[0], packet_data[0][0]);
>
>
> -->In the while loop I called pcap_next_ex() 4 times. So my expectation
> is:- packet_data[0] will show different value once since the previous
> memory for packet_data[0] was freed while calling the wile loop for
> second time.
>
> --> but I am getting the same address value.
> --> If that memory freed and also by chance it shows the same memory
> allocated then the value of the packet_data (i.e. packet_data[0][0])
> should have some unpredictable value.
> --> But I got the same value for packet_data(i.e packet_data[0][0])
>
> --> But the print after the pcap_close(fp) shows some unpredictable
> value for packet_data(i.e packet_data[0][0]).
>
> So I got confirmation upon your second point.
>
> Dear can you give me any example which can proof your 1st time.
> I am asking for the proof since I need to convince all my management
> group.
>
>
> Waitin 4 ur reply
> Umesh
>
>
>
> -----Original Message-----
> From: winpcap-users-bounces at winpcap.org
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
> Sent: Monday, July 07, 2008 9:19 PM
> To: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] only when ethereal is ON
>
> Hi,
>
> the pointers returned by pcap_next_ex must NOT be released, and they are
>
> valid until
> - the next call to pcap_next_ex/pcap_loop/pcap_dispatch
> - you close the capture instance of pcap_close
>
> (whatever happens first)
>
> Have a nice day
> GV
>
> ----- Original Message ----- 
> From: "Umesh Chandra Sahoo" <USahoo at ixiacom.com>
> To: <winpcap-users at winpcap.org>
> Sent: Monday, July 07, 2008 6:44 AM
> Subject: [Winpcap-users] only when ethereal is ON
>
>
>> Hi,
>> Can any one tell me how to clear the memory taken by pcap_next_ex().
>> --> What is the lifespan of that variable
>> lifespan of that variable
>>
>>
>> --> Is that ponter automaticallyreleases?
>>
>> Regards
>> Umesh
>>
>>
>>
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users