[Winpcap-users] pcap_next_ex isnotupdatingthepointertopcap_pkthdr structure

Thu Nov 8 16:13:28 GMT 2007

----- Original Message ----- 
  From: Renato Araújo Ferreira 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, November 07, 2007 6:39 PM
  Subject: Re: [Winpcap-users] pcap_next_ex isnotupdatingthepointertopcap_pkthdr structure

  OK, GV!! You were right (as usually)....

  Now I´m copying all the data:

    objPacket = new Packet();
    objPacket->Timestamp.tv_sec = Header->ts.tv_sec;
    objPacket->Timestamp.tv_usec = Header->ts.tv_usec;
    objPacket->Length = Header->len;
    objPacket->Data = (u_char*) malloc(objPacket->Length);
    memcpy_s((void*)objPacket->Data,objPacket->Length,Data,objPacket->Length);
    objCapturer->add(objPacket);

  Is there any problem yet?

No. That code should work. Be careful at calling malloc() for every packet you receive. Under heavy network traffic, calling malloc() for every packet could kill your application (as a matter of facts, malloc is slow). A better way to do that is preallocating the buffers for the packets (e.g. with the maximum packet size on your link layer). 

Have a nice day
GV

  Thanks,

  Renato...

    ----- Original Message ----- 
    From: Renato Araújo Ferreira 
    To: winpcap-users at winpcap.org 
    Sent: Wednesday, November 07, 2007 11:19 PM
    Subject: Re: [Winpcap-users] pcap_next_ex is notupdatingthepointertopcap_pkthdr structure

    GV,

    I already changed the code.

    Before:

    =================================================================================
     struct Packet
     {
      struct pcap_pkthdr* Header;
      const u_char* Data;
     };

     ...

     while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
     {
       ...

      objPacket = new Packet();
      objPacket->Header = Header;
      objPacket->Data = Data;
      objCapturer->add(objPacket);

      ...
     }
    =================================================================================

    Now:

    =================================================================================
     struct Packet
     {
      struct timeval Timestamp;
      bpf_u_int32 Length;
      const u_char* Data;
     };

      ...

     while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )
     {
       ...

      objPacket = new Packet();
      objPacket->Timestamp.tv_sec = Header->ts.tv_sec;
      objPacket->Timestamp.tv_usec = Header->ts.tv_usec;
      objPacket->Length = Header->len;
      objPacket->Data = Data;
      objCapturer->add(objPacket);

      ...
     }
    =================================================================================

    Now all appear to be working properly.

    Are you sure about copying the data array too? This array aren´t malloc'ed again in each call of pcap_next_ex()? I think so, because their address are always changing.

    Thanks,

    Renato...

      ----- Original Message ----- 
      From: Gianluca Varenni 
      To: winpcap-users at winpcap.org 
      Sent: Wednesday, November 07, 2007 10:36 PM
      Subject: Re: [Winpcap-users] pcap_next_ex is not updatingthepointertopcap_pkthdr structure

      Yes, you definitely need to copy both the packet and the header returned by pcap_next_ex(). The header and the data pointer returned by pcap_next_ex() are valid up to the next call to pcap_next_ex() or pcap_close(), whatever comes first.

      Have a nice day
      GV

        ----- Original Message ----- 
        From: Renato Araújo Ferreira 
        To: winpcap-users at winpcap.org 
        Sent: Wednesday, November 07, 2007 4:14 PM
        Subject: Re: [Winpcap-users] pcap_next_ex is not updating thepointertopcap_pkthdr structure

        GV,

        It's the problem. I'm using a thread that put each packet in a queue while another thread process their data.

        So I think that I need to copy the content of 'len' and 'ts' members before putting in the queue, instead of using the 'header' structure directly.

        Thanks,

        Renato.

          ----- Original Message ----- 
          From: Gianluca Varenni 
          To: winpcap-users at winpcap.org 
          Sent: Wednesday, November 07, 2007 2:14 PM
          Subject: Re: [Winpcap-users] pcap_next_ex is not updating the pointertopcap_pkthdr structure

          This is normal. pcap_next_ex() reuses an internal field of the pcap_t handle to return Header. And this gets rewritten for every packet.

          Which specific adapter are you capturing from?

          Have a nice day
          GV
            ----- Original Message ----- 
            From: Renato Araújo Ferreira 
            To: winpcap-users at winpcap.org 
            Sent: Tuesday, November 06, 2007 9:01 PM
            Subject: [Winpcap-users] pcap_next_ex is not updating the pointer topcap_pkthdr structure

            Hello,

            Im using 'pcap_next_ex()' to receive the packets in a loop, but i found a problem. A lot of packets appeared to be the same length and timestamp, but Im sure that that value was wrong, confirmed in wireshark (great tool).

            Looking for a solution, I found this strange behavior:

              struct pcap_pkthdr* Header;
              const u_char* Data;
              while( (Results = pcap_next_ex( PcapHandler, &Header, &Data)) >= 0 )

            In the code above, I can see in the debug mode that 'Data' pointer address are updated all the time, while 'Header' return a repeated address value many times. 'Header' pointer are updated only some times.

            Could someone help me?

            thanks,

            Renato....

--------------------------------------------------------------------

            _______________________________________________
            Winpcap-users mailing list
            Winpcap-users at winpcap.org
            https://www.winpcap.org/mailman/listinfo/winpcap-users

----------------------------------------------------------------------

          _______________________________________________
          Winpcap-users mailing list
          Winpcap-users at winpcap.org
          https://www.winpcap.org/mailman/listinfo/winpcap-users

------------------------------------------------------------------------

        _______________________________________________
        Winpcap-users mailing list
        Winpcap-users at winpcap.org
        https://www.winpcap.org/mailman/listinfo/winpcap-users

--------------------------------------------------------------------------

      _______________________________________________
      Winpcap-users mailing list
      Winpcap-users at winpcap.org
      https://www.winpcap.org/mailman/listinfo/winpcap-users

----------------------------------------------------------------------------

    _______________________________________________
    Winpcap-users mailing list
    Winpcap-users at winpcap.org
    https://www.winpcap.org/mailman/listinfo/winpcap-users

------------------------------------------------------------------------------

  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071108/8af66fba/attachment.htm