<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>Yes, you definitely need to copy both the packet and the
header returned by pcap_next_ex(). The header and the data pointer returned by
pcap_next_ex() are valid up to the next call to pcap_next_ex() or pcap_close(),
whatever comes first.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007 4:14
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] pcap_next_ex
is not updating thepointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>GV,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>It's the problem. I'm using a thread that put
each packet in a queue while another thread process their data.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>So I think that I need to copy the content
of 'len' and 'ts' members before putting in the queue, instead of using the
'header' structure directly.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Renato.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=gianluca.varenni@cacetech.com
href="mailto:gianluca.varenni@cacetech.com">Gianluca Varenni</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007 2:14
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users]
pcap_next_ex is not updating the pointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT size=2>This is normal. pcap_next_ex() reuses an internal
field of the pcap_t handle to return Header. And this gets rewritten for
every packet.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Which specific adapter are you capturing
from?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, November 06, 2007 9:01
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] pcap_next_ex
is not updating the pointer topcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>Hello,</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Im using 'pcap_next_ex()' to receive the
packets in a loop, but i found a problem. A lot of packets appeared to be
the same length and timestamp, but Im sure that that value was wrong,
confirmed in wireshark (great tool).</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Looking for a solution, I found this strange
behavior:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2> struct pcap_pkthdr* Header;<BR>
const u_char* Data;<BR> while( (Results = pcap_next_ex( PcapHandler,
&Header, &Data)) >= 0 )<BR> <BR>In the code above, I can
see in the debug mode that 'Data' pointer address are updated all the
time, while 'Header' return a repeated address value many times. 'Header'
pointer are updated only some times.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Could someone help
me?<BR> <BR>thanks,<BR> <BR>Renato....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>