On Sep 25, 2003, at 7:39 AM, Dario Tamburi wrote:
len of the struct pcap_pkthdr is in byte, is correct?
If "len of the struct pcap_pkthdr" means the "len" field of that structure, then, yes, both "len" and "caplen" are in bytes. "len" is the number of bytes that were in the packet as it was received (or sent) by the machine running the libpcap/WinPcap application; "caplen" is the number of bytes that are in the packet as read from libpcap/WinPcap. ("caplen" could be less than "len" if you specified a snapshot length in "pcap_open_live()", "pcap_open_offline()", or "pcap_open()", and that snapshot length is less than the length of the packet.)
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
