On Thu, Feb 08, 2001 at 10:02:27AM -0500, Michael T. Stolarchuk wrote:
> the doc says:
>
> pcap_next() returns a u_char pointer to the next packet.
>
> When i read that, i thought it meant that it would `peek' into
> the next packet. but what it really does is dispatch the
> packet, and then hand it back...
How about
pcap_next() reads the next packet (by calling pcap_dis-
patch() with a cnt of 1) and returns a u_char pointer to
the data in that packet. (The pcap_pkthdr struct for that
packet is not supplied.)
which also notes that all you get is the data - no time stamp or
lengths.
(I'm curious where "pcap_next()" is useful, given that, as noted, the
lengths aren't supplied, so you know only that
you don't have more data than the snapshot length
and
you presumably have no *less* data than the minimum packet
length
but, unless there's a length field somewhere in the packet, or the
packet type implies the length, you don't know how much data you have.)
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
