<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>----- Original Message ----- </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007 6:39
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] pcap_next_ex
isnotupdatingthepointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>OK, GV!! You were right (as
usually)....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Now I´m copying all the data:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2> objPacket = new
Packet();<BR> objPacket->Timestamp.tv_sec =
Header->ts.tv_sec;<BR> objPacket->Timestamp.tv_usec =
Header->ts.tv_usec;<BR> objPacket->Length =
Header->len;<BR> objPacket->Data = (u_char*)
malloc(objPacket->Length);<BR> memcpy_s((void*)objPacket->Data,objPacket->Length,Data,objPacket->Length);<BR> objCapturer->add(objPacket);</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Is there any problem yet?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BLOCKQUOTE>
<DIV><FONT face=Arial size=2>No. That code should work. Be careful at calling
malloc() for every packet you receive. Under heavy network traffic, calling
malloc() for every packet could kill your application (as a matter of facts,
malloc is slow). A better way to do that is preallocating the buffers for the
packets (e.g. with the maximum packet size on your link layer). </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Have a nice day</FONT></DIV>
<DIV><FONT face=Arial size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Renato...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007
11:19 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users]
pcap_next_ex is notupdatingthepointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>GV,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I already changed the code.</FONT></DIV>
<DIV> </DIV><FONT face=Arial size=2>
<DIV><BR>Before:</DIV>
<DIV> </DIV>
<DIV>=================================================================================<BR> struct
Packet<BR> {<BR> struct pcap_pkthdr*
Header;<BR> const u_char* Data;<BR> };</DIV>
<DIV> </DIV>
<DIV> ...</DIV>
<DIV> </DIV>
<DIV> while( (Results = pcap_next_ex( PcapHandler, &Header,
&Data)) >= 0 )<BR> {<BR>
...<BR> <BR> objPacket = new
Packet();<BR> objPacket->Header =
Header;<BR> objPacket->Data =
Data;<BR> objCapturer->add(objPacket);<BR> <BR> ...<BR> }<BR>=================================================================================</DIV>
<DIV> </DIV>
<DIV><BR>Now:</DIV>
<DIV> </DIV>
<DIV>=================================================================================<BR> struct
Packet<BR> {<BR> struct timeval
Timestamp;<BR> bpf_u_int32 Length;<BR> const u_char*
Data;<BR> };</DIV>
<DIV> </DIV>
<DIV> ...</DIV>
<DIV> </DIV>
<DIV> while( (Results = pcap_next_ex( PcapHandler, &Header,
&Data)) >= 0 )<BR> {<BR>
...<BR> <BR> objPacket = new
Packet();<BR> objPacket->Timestamp.tv_sec =
Header->ts.tv_sec;<BR> objPacket->Timestamp.tv_usec =
Header->ts.tv_usec;<BR> objPacket->Length =
Header->len;<BR> objPacket->Data =
Data;<BR> objCapturer->add(objPacket);<BR> <BR> ...<BR> }<BR>=================================================================================<BR> </DIV>
<DIV> </DIV>
<DIV>Now all appear to be working properly.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Are you sure about copying the data array too? This array aren´t
malloc'ed again in each call of pcap_next_ex()? I think so, because their
address are always changing.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Thanks,</DIV>
<DIV> </DIV>
<DIV>Renato...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=gianluca.varenni@cacetech.com
href="mailto:gianluca.varenni@cacetech.com">Gianluca Varenni</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007
10:36 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users]
pcap_next_ex is not updatingthepointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT size=2>Yes, you definitely need to copy both the packet and the
header returned by pcap_next_ex(). The header and the data pointer
returned by pcap_next_ex() are valid up to the next call to pcap_next_ex()
or pcap_close(), whatever comes first.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07, 2007
4:14 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users]
pcap_next_ex is not updating thepointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>GV,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>It's the problem. I'm using a thread that
put each packet in a queue while another thread process their
data.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>So I think that I need to copy the
content of 'len' and 'ts' members before putting in the queue, instead
of using the 'header' structure directly.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Renato.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=gianluca.varenni@cacetech.com
href="mailto:gianluca.varenni@cacetech.com">Gianluca Varenni</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, November 07,
2007 2:14 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users]
pcap_next_ex is not updating the pointertopcap_pkthdr structure</DIV>
<DIV><BR></DIV>
<DIV><FONT size=2>This is normal. pcap_next_ex() reuses an
internal field of the pcap_t handle to return Header. And this gets
rewritten for every packet.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Which specific adapter are you capturing
from?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=marina.peixe@terra.com.br
href="mailto:marina.peixe@terra.com.br">Renato Araújo Ferreira</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, November 06,
2007 9:01 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users]
pcap_next_ex is not updating the pointer topcap_pkthdr
structure</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>Hello,</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Im using 'pcap_next_ex()' to receive
the packets in a loop, but i found a problem. A lot of packets
appeared to be the same length and timestamp, but Im sure that that
value was wrong, confirmed in wireshark (great tool).</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Looking for a solution, I found this
strange behavior:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2> struct pcap_pkthdr*
Header;<BR> const u_char* Data;<BR> while( (Results =
pcap_next_ex( PcapHandler, &Header, &Data)) >= 0
)<BR> <BR>In the code above, I can see in the debug mode that
'Data' pointer address are updated all the time, while 'Header'
return a repeated address value many times. 'Header' pointer are
updated only some times.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2>Could someone help
me?<BR> <BR>thanks,<BR> <BR>Renato....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>