<IMG SRC= "http://pcmail.nate.com/NateConfirmMgr.php?act=confirm&key=1128607329_winpcap-users@winpcap.org&from=|PROFILE2|55|132|15|kyudan@nate.com" height="0" width="0"><HTML>
<HEAD>
<META NAME="GENERATOR" Content="Microsoft DHTML Editing Control">
<TITLE></TITLE>
</HEAD>
<BODY 
style="FONT-SIZE: 13px; BORDER-TOP-STYLE: none; FONT-FAMILY: ±¼¸²; BORDER-RIGHT-STYLE: none; BORDER-LEFT-STYLE: none; BORDER-BOTTOM-STYLE: none">
<DIV>
<P>My code is for studying pcaplib as follow.</P>
<P>#include &lt;stdio.h&gt;<BR>#include &lt;pcap.h&gt;<BR>#include 
&lt;netinet/if_ether.h&gt;</P>
<P>&nbsp;</P>
<P>void packet_handler(u_char *param, const struct pcap_pkthdr *header, const 
u_char *pkt_data);</P>
<P>main(int argc, char **argv) {</P>
<P>&nbsp;&nbsp;&nbsp; pcap_t *fp;<BR>&nbsp;&nbsp;&nbsp; char 
errbuf[PCAP_ERRBUF_SIZE];</P>
<P>&nbsp;&nbsp;&nbsp; if(argc != 2){</P>
<P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; printf("usage: %s filename\n", 
argv[0]);<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return -1;</P>
<P>&nbsp;&nbsp;&nbsp; }</P>
<P>&nbsp;&nbsp;&nbsp; /* Open a capture file */<BR>&nbsp;&nbsp;&nbsp; if ( (fp = 
pcap_open_offline(argv[1], errbuf) ) == NULL)<BR>&nbsp;&nbsp;&nbsp; 
{<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; fprintf(stderr,"\nError opening 
dump file\n");<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return 
-1;<BR>&nbsp;&nbsp;&nbsp; }</P>
<P>&nbsp;&nbsp;&nbsp; // read and dispatch packets until EOF is 
reached<BR>&nbsp;&nbsp;&nbsp; pcap_loop(fp, 0, packet_handler, NULL);</P>
<P>&nbsp;&nbsp;&nbsp; return 0;<BR>}</P>
<P>void packet_handler(u_char *param, const struct pcap_pkthdr *header, const 
unsigned char *pkt_data)<BR>{<BR>&nbsp;struct ether_header 
*etherh;<BR>&nbsp;unsigned short e_type;<BR>&nbsp;etherh=(struct ether_header 
*)pkt_data;</P>
<P>&nbsp;printf("%d \n",etherh-&gt;ether_type);<BR>}<BR></P>
<P>----------</P>
<P>when I execute this code, I cannt get ether-&gt;type value, 0.</P>
<P>But&nbsp;when I execute tcpdump&nbsp;with same dumpfile, I got normal 
value.</P>
<P>and I change pcap_open_offline to _live, then that code is normally 
execute.</P>
<P>Why this code is irrationally execute?</P>
<P>thank you.</P></DIV>
</BODY>
</HTML>
<br>
<br>
<style>.footerCss {font-family: "±¼¸²";font-size: 9pt;}</style>
<table width="600" border="0" cellspacing="0" cellpadding="0">
  <tr>
        <td><table width="100%" border="0" cellspacing="0" cellpadding="0">
                <tr>
                  <td height="7"><img src="http://mail.nate.com/web/footer/img/jem.gif" height="1"></td>
                <tr>
                  <td><img src="http://mail.nate.com/web/footer/img/natelogo.gif" width="193" height="23"></td>
                </tr>
                <tr>
                  <td height="7"> </tr>
                <tr>
                  <td bgcolor="EFEFEF"><table width="100%" border="0" cellspacing="1" cellpadding="0">
                          <tr>
                                <td height="57" align="center" bgcolor="F7F7F7"><table width="98%" border="0" cellspacing="1" cellpadding="0">
                                        <tr>
                                          <td><table width="100%" border="0" cellspacing="0" cellpadding="0">
                                                  <tr>
                                                        <td width="306"><table width="100%" border="0" cellspacing="0" cellpadding="0">
                                                                <tr>
                                                                  <td width="80"><img src="http://mail.nate.com/web/footer/img/040115_ecard.gif" width="80" height="45"></td>
                                                                  <td width="10">&nbsp;</td>
                                                                  <td align="center" class="footerCss"><table width="100%" border="0" cellspacing="0" cellpadding="0">
                                                                          <tr>
                                                                                <td class="footerCss">
                                                                                 <a href="http://ecard.nate.com" target="_new">
                                                                                 <font color="84027E">»õ·Î¿î ÇüÅÂÀÇ ÀÌÆ÷½ºÆ®Ä«µå ¼­ºñ½º</font>
                                                                                 </a>
                                                                                </td>
                                                                          </tr>
                                                                          <tr>
                                                                                <td height="5"> </tr>
                                                                          <tr>
                                                                                <td class="footerCss">¿¹»Û ¿ìÆí ¿±¼­·Î ¸¶À½À» Àü´Þ</td>
                                                                          </tr>
                                                                        </table></td>
                                                                </tr>
                                                          </table></td>
                                                        <td width="1" background="img/bg01.gif">
                                                        <td width="306"><table width="100%" border="0" cellspacing="0" cellpadding="0">
                                                                <tr>
                                                                  <td width="10">&nbsp;</td>
                                                                  <td width="80"><img src="http://mail.nate.com/web/footer/img/new_nate.gif" width="80" height="45" border="0"></td>
                                                                  <td width="10">&nbsp;</td>
                                                                  <td width="207" align="center" class="footerCss"><table width="100%" border="0" cellspacing="0" cellpadding="0">
                                                                          <tr>
                                                                                <td class="footerCss">
                                                                                  <a href="http://www.nate.com/" target="_new">
                                                                                  <font color="84027E">½ÎÀÌ¿ùµå ÆäÀÌÆÛ±îÁö Ã£¾ÆÁØ´Ù!</font>
                                                                                  </a>
                                                                                 </td>
                                                                          </tr>
                                                                          <tr>
                                                                                <td height="5"> </tr>
                                                                          <tr>
                                                                                <td class="footerCss">»õ·Î¿öÁø ³×ÀÌÆ®´åÄÄ ½áº¸¼Ì³ª¿ä?</td>
                                                                          </tr>
                                                                        </table></td>
                                                                </tr>
                                                          </table></td>
                                                  </tr>
                                                </table></td>
                                        </tr>
                                  </table></td>
                          </tr>
                        </table></td>
                </tr>

          </table></td>
  </tr>
</table>