[Winpcap-users] about pcap_stat data fields

Renato Araújo Ferreira marina.peixe at terra.com.br
Sun Dec 28 18:30:57 GMT 2008

Hello all,

I have some doubts about pcap_stat struct as follow:

- Which kinds of packet drop 'ps_drop' counts? Packet discarded by filter 
(pcap_compiler), performance bottlenecks (full kernel buffer) or both?

- Is 'ps_capt' a simple difference between 'ps_recv' and 'ps_drop'? Why this 
field exists?

- Is 'ps_netdrop' field the total of packets lost before they reach the 
local NIC? How the system or winpcap could know this value?

- And, finaly, can I safely define HAVE_REMOTE to access the 'ps_capt' and 
'ps_netdrop' fields?

Could someone help me?


Renato A. Ferreira 

More information about the Winpcap-users mailing list