[Winpcap-users] RE: Determining packet size in bytes from live capture

[Esmond Pitt]

> From my understanding "(((*(LONGLONG*)(pkt_data + 8)) * 1000000) /
(delay))" will
give you the average number of bytes per second, but i'm not certain how to
translate that into simply the number of bytes transferred. 

The sample is a little over-elaborate, and what's actually in the packet
isn't documented anywhere properly. The first 64 bits are the number of
packets transferred in this sample and the second 64 bits are the number of
bytes transferred, both in this sample period. Packets per second and
bits/bytes per second are up to you, and that's what the example shows you
how to do. But the raw data you want is already in the packet.

EJP