[Winpcap-users] pcap_fopen_offline() and pcap_close()

[Guy Harris]

On Jan 27, 2012, at 2:34 AM, Boaz Brickner wrote:

> In Pcap.Net (http://pcapdot.net), I'm using pcap_fopen_offline() to open files.
> Since this function assumes the FILE* argument it gets is already open, does calling pcap_close() on its output also closes that FILE*

Yes, it does.

And, yes, this does, I think, run the risk that you'll open the FILE * with one version of the C runtime library and have WinPcap close it with another version, which I am told

	1) can happen

and

	2) can cause crashes and other problems.

(I come from the UN*X world, where that sort of mismatched-versions-of-the-C-library problem simply doesn't happen.  You can allocate stuff in a library and free it in the main program or another library, and open a FILE * in the main program and close it in a library or open it in a library and close it in the main program or another library, and all the operations will be done by the same version of the C library.)

If this is causing problems, you might want to see whether you can use pcap_hopen_offline() with a HANDLE instead.