<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16640" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>If you use the statistical mode, whenever you call
pcap_next_ex or similar you get the number of packets and the number of bytes
transferred from the last call of pcap_next_ex. If you want the total amount of
bytes/packets, just keep a local counter of the bytes/packets, and increment it
of the number of packets/bytes received with pcap_next_ex</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Moreover, if you are working in statistics mode, you don't get
the packet size. You get statistics. If you want to know the size of each
received packets, you need to go with the normal capture mode and compute
the statistics on your own.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have you looked at the sample called "tcptop" in the WinPcap
developer's pack?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=squarerootofeggnog@gmail.com
href="mailto:squarerootofeggnog@gmail.com">Tom Morgan</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, June 09, 2008 11:15
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Determining
packet size in bytes from live capture.</DIV>
<DIV><BR></DIV>I am working on a program to monitor the network and keep track
of the total number of bytes transferred. I have tried using the statistical
mode (not sure if that is the best approach, but it seems correct) and
modifying the Bps.QuadPart for my purposes, but cannot seem to get things
working just right (maybe i am just not understanding how that works). >From my
understanding "(((*(LONGLONG*)(pkt_data + 8)) * 1000000) / (delay))" will give
you the average number of bytes per second, but i'm not certain how to
translate that into simply the number of bytes transferred. It seems like it
would be something simple, and perhaps I am just not looking at it the right
way.<BR><BR>So my main question is, how does one determine the size of a
packet? I'm not worried about separating the header from the data, I am simply
interested in determining and keeping track of the overall size of the
packet.<BR>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>