[Winpcap-users] pcap_next_ex is not updatingthepointertopcap_pkthdr structure

[Renato Araújo Ferreira]

GV,

I already changed the code.


Before:

=================================================================================
 struct Packet
 {
  struct pcap_pkthdr* Header;
  const u_char* Data;
 };

 ...

 while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
 {
   ...
 
  objPacket = new Packet();
  objPacket->Header = Header;
  objPacket->Data = Data;
  objCapturer->add(objPacket);
  
  ...
 }
=================================================================================


Now:

=================================================================================
 struct Packet
 {
  struct timeval Timestamp;
  bpf_u_int32 Length;
  const u_char* Data;
 };

  ...

 while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
 {
   ...
 
  objPacket = new Packet();
  objPacket->Timestamp.tv_sec = Header->ts.tv_sec;
  objPacket->Timestamp.tv_usec = Header->ts.tv_usec;
  objPacket->Length = Header->len;
  objPacket->Data = Data;
  objCapturer->add(objPacket);
  
  ...
 }
=================================================================================
 

Now all appear to be working properly.


Are you sure about copying the data array too? This array aren´t malloc'ed again in each call of pcap_next_ex()? I think so, because their address are always changing.


Thanks,

Renato...

  ----- Original Message ----- 
  From: Gianluca Varenni 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, November 07, 2007 10:36 PM
  Subject: Re: [Winpcap-users] pcap_next_ex is not updatingthepointertopcap_pkthdr structure


  Yes, you definitely need to copy both the packet and the header returned by pcap_next_ex(). The header and the data pointer returned by pcap_next_ex() are valid up to the next call to pcap_next_ex() or pcap_close(), whatever comes first.

  Have a nice day
  GV

    ----- Original Message ----- 
    From: Renato Araújo Ferreira 
    To: winpcap-users at winpcap.org 
    Sent: Wednesday, November 07, 2007 4:14 PM
    Subject: Re: [Winpcap-users] pcap_next_ex is not updating thepointertopcap_pkthdr structure


    GV,

    It's the problem. I'm using a thread that put each packet in a queue while another thread process their data.

    So I think that I need to copy the content of 'len' and 'ts' members before putting in the queue, instead of using the 'header' structure directly.

    Thanks,

    Renato.

      ----- Original Message ----- 
      From: Gianluca Varenni 
      To: winpcap-users at winpcap.org 
      Sent: Wednesday, November 07, 2007 2:14 PM
      Subject: Re: [Winpcap-users] pcap_next_ex is not updating the pointertopcap_pkthdr structure


      This is normal. pcap_next_ex() reuses an internal field of the pcap_t handle to return Header. And this gets rewritten for every packet.

      Which specific adapter are you capturing from?

      Have a nice day
      GV
        ----- Original Message ----- 
        From: Renato Araújo Ferreira 
        To: winpcap-users at winpcap.org 
        Sent: Tuesday, November 06, 2007 9:01 PM
        Subject: [Winpcap-users] pcap_next_ex is not updating the pointer topcap_pkthdr structure


        Hello,

        Im using 'pcap_next_ex()' to receive the packets in a loop, but i found a problem. A lot of packets appeared to be the same length and timestamp, but Im sure that that value was wrong, confirmed in wireshark (great tool).

        Looking for a solution, I found this strange behavior:

          struct pcap_pkthdr* Header;
          const u_char* Data;
          while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
          
        In the code above, I can see in the debug mode that 'Data' pointer address are updated all the time, while 'Header' return a repeated address value many times. 'Header' pointer are updated only some times.

        Could someone help me?
         
        thanks,
         
        Renato....



------------------------------------------------------------------------


        _______________________________________________
        Winpcap-users mailing list
        Winpcap-users at winpcap.org
        https://www.winpcap.org/mailman/listinfo/winpcap-users



--------------------------------------------------------------------------


      _______________________________________________
      Winpcap-users mailing list
      Winpcap-users at winpcap.org
      https://www.winpcap.org/mailman/listinfo/winpcap-users



----------------------------------------------------------------------------


    _______________________________________________
    Winpcap-users mailing list
    Winpcap-users at winpcap.org
    https://www.winpcap.org/mailman/listinfo/winpcap-users



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071108/faa0fa49/attachment-0001.htm