Hi there! In the latest release as well as git HEAD, pcap_next_ex calls pcap_oneshot (the default callback) instead of p->oneshot_callback like pcap_next does.
This means that packets change underneath one application when using Linux and its mmapped ring buffer. Additionally, I think the manpages of pcap_next and pcap_dispatch should describe whether or not the user is supposed the free the packet's memory. My understanding is that the packet has dynamic extent in case of pcap_dispatch but in case of pcap_next / pcap_next_ex the user is supposed to free the packet buffer -- is that correct? Thanks for your time! -T. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.