When I use pcap_next_ex like this:
struct pcap_pkthdr *pkthdr;
...
pcap_next_ex(p, &pkthdr, &pktp);
The returned pkthdr is invalid ! After do some trick like this:
struct a4_pcap_pkthdr {
u_int32_t tv_sec;
u_int32_t tv_usec;
u_int32_t caplen; /* length of portion present */
u_int32_t len; /* length this packet (off wire) */
} __attribute__ ((aligned (4)));
...
struct pcap_pkthdr *pkthdr;
struct a4_pcap_pkthdr *pkthdr2;
...
pcap_next_ex(p, &pkthdr, &pktp);
pkthdr2 = (struct a4_pcap_pkthdr *) pkthdr;
The returned pkthdr2 is OK. What's the correct usage ?
Thanks,
Dongsheng Song