[Winpcap-users] Determining packet size in bytes from live capture.

[Gianluca Varenni]

If you use the statistical mode, whenever you call pcap_next_ex or similar you get the number of packets and the number of bytes transferred from the last call of pcap_next_ex. If you want the total amount of bytes/packets, just keep a local counter of the bytes/packets, and increment it of the number of packets/bytes received with pcap_next_ex

Moreover, if you are working in statistics mode, you don't get the packet size. You get statistics. If you want to know the size of each received packets, you need to go with the normal capture mode and compute the statistics on your own.

Have you looked at the sample called "tcptop" in the WinPcap developer's pack?

Have a nice day
GV
  ----- Original Message ----- 
  From: Tom Morgan 
  To: winpcap-users at winpcap.org 
  Sent: Monday, June 09, 2008 11:15 AM
  Subject: [Winpcap-users] Determining packet size in bytes from live capture.


  I am working on a program to monitor the network and keep track of the total number of bytes transferred. I have tried using the statistical mode (not sure if that is the best approach, but it seems  correct) and modifying the Bps.QuadPart for my purposes, but cannot seem to get things working just right (maybe i am just not understanding how that works). From my understanding "(((*(LONGLONG*)(pkt_data + 8)) * 1000000) / (delay))" will give you the average number of bytes per second, but i'm not certain how to translate that into simply the number of bytes transferred. It seems like it would be something simple, and perhaps I am just not looking at it the right way.

  So my main question is, how does one determine the size of a packet? I'm not worried about separating the header from the data, I am simply interested in determining and keeping track of the overall size of the packet.



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20080610/facac4ee/attachment.htm