On Wed, Sep 04, 2002 at 07:58:24PM +0800, Iain McAleer wrote:
> Sorry I think you missunderstood my question. I'm actually wondering how
> pcap_datalink() works......I can't seem to find where it actually gets the
> link type.......
Your question said "link offset", not "data link type".
"pcap_datalink()", as a look at the code shows, gets it from the
"linktype" member of the "pcap_t" to which it was handed a pointer.
"linktype" is filled in by
"pcap_open_live()";
"pcap_open_dead()";
"pcap_open_offline()".
"pcap_open_live()" is platform-dependent, and the way it gets the value
to put into "linktype" is also platform-dependent.
"pcap_open_dead()" fills it in with the argument supplied to it.
"pcap_open_offline()" gets the value by using the link-layer type value
in the file header of the capture file it's opening.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
