[Winpcap-users] Partial packet after pcap_next_ex()

Gisle Vanem gvanem at broadpark.no
Thu Feb 12 20:05:03 GMT 2009

"Guy Harris" <guy at alum.mit.edu> wrote:

> If the pointer filled in by a pcap_next_ex() call points to text,  
> rather than to a chunk of data that begins with a link-layer header,  
> that's a bug in libpcap/WinPcap.

I find that hard to believe: There is no such bug in WinPcap (not in
NPF.SYS ver at least). I've captured terabytes of data and never
seen what the OP states. Let us see some code before jumping to


More information about the Winpcap-users mailing list