Re: [tcpdump-workers] Getting TCP packet payload length with pcap

2007-08-08 Thread Nick Chorley
e same thing as this (using Jpcap, http://jpcap.sourceforge.net) and running the two programs on the same data gives different values. For example, the first 5 values given by my Java program are 5, 0, 0, 0, 0 whereas using libpcap with C/C++ gives 14540, 13260, 12240, 15300, 12240. I've a

Re: [tcpdump-workers] Getting TCP packet payload length with pcap

2007-08-08 Thread Nick Chorley
;tcphdr" for more information. Yes, I was aware of this and indeed I am using the Linux definition, since I haven't put #define __FAVOR_BSD in my program. Regards, NC On 8/8/07, Nick Chorley <[EMAIL PROTECTED]> wrote: > > > > Hi, > > > > I have found anot

[tcpdump-workers] Getting TCP packet payload length with pcap

2007-08-08 Thread Nick Chorley
Hi, I have found another post in the mailing list about this ( http://www.tcpdump.org/lists/workers/2005/05/msg00021.html), but it appears to use structs sniff_ip and sniff_tcp that are declared in the sniffex program. In my program, I'm using the structs for the IP and TCP headers as defined in n

Re: [tcpdump-workers] Pcap filters for saved capture files?

2007-08-06 Thread Nick Chorley
On 06/08/2007, Guy Harris <[EMAIL PROTECTED]> wrote: > > Nick Chorley wrote: > > > I'm using libpcap in programs I'm writing and I already have saved > capture > > files. I've seen many examples of using pcap_compile() and > pcap_setfilter() >

Re: [tcpdump-workers] Pcap filters for saved capture files?

2007-08-03 Thread Nick Chorley
Hi, I'm using libpcap in programs I'm writing and I already have saved capture files. I've seen many examples of using pcap_compile() and pcap_setfilter() for capturing live packets, but none for use with offline files. The last argument to pcap_compile() seems to be an IP address, but obviously i