[Winpcap-users] pcap_stas

[Guy Harris]

On Jul 20, 2009, at 9:19 PM, Prasanna Kumar Nelam wrote:

> Thank u very much for ur help, I am using Redhat enterprise version  
> linux,
> where 2.6.9-42ELsmp is the kernel version, and libpcap version is
> libpcap-0.8.3-10.RHEL4.

Libpcap 0.8.3 had a bug on Linux wherein pcap_stats() would, on  
platforms where

	1) the kernel supplies packet capture/filter statistics, which is  
true at least as of the 2.4.20 kernel (so it's true in the 2.6.9 kernel)

and

	2) libpcap was compiled to use that (which it is by default)

the counts it returns are counts from the previous time pcap_stats()  
was called (or from the start of the capture if pcap_stats() is being  
called for the first time), not counts from the start of the capture.

In that case, the received packets value is the number of packets  
received since the last time you called pcap_stats(), not since the  
capture started, and the same is true of the dropped packets value.

That bug is fixed in newer versions of libpcap.