[Winpcap-users] Getting protocol from IPv4 header

[Guy Harris]

Ravi Sankar wrote:

> 
> 	ip_header *l_pIpHeader = NULL;
> 
>          /* pkt_data is the pointer to unsigned char
> which points to the received packet.*/
> 	/* retireve the position of the ip header */
> 	l_pIpHeader = (ip_header *) (pkt_data +
> 		14); //length of ethernet header

...assuming, of course, that the packet has an Ethernet header.  (That's 
more likely to be true on Windows, where a lot of the networking stack 
assumes packets have Ethernet or Ethernet-like headers, and the software 
below the IP layer in the networking stack puts fake Ethernet packets on 
the packets if necessary - for example, on PPP or 802.11 packets - than 
on some other OSes.)