On Feb 4, 2011, at 5:00 AM, Tobias C Rittweiler wrote: > In the latest release as well as git HEAD, pcap_next_ex > calls pcap_oneshot (the default callback) instead of > p->oneshot_callback like pcap_next does. > > This means that packets change underneath one application > when using Linux and its mmapped ring buffer.
I've checked a fix into the trunk and the 1.1 branch. > Additionally, I think the manpages of pcap_next and > pcap_dispatch should describe whether or not the user > is supposed the free the packet's memory. My understanding > is that the packet has dynamic extent in case of pcap_dispatch > but in case of pcap_next / pcap_next_ex the user is supposed to > free the packet buffer -- is that correct? No. The packet buffer is allocated by libpcap, and is attached to the pcap_t. It's guaranteed (with the above fix) not to change until either pcap_loop(), pcap_dispatch(), pcap_next(), or pcap_next_ex() is called. I've updated the man pages to reflect the lifetime of the packet header and packet data.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
