Originally Posted by
ppdouble
I defined it as pointer because pcap_next_ex need the second argument as pcap_pkthdr**
You don't need to do that in the struct. The way pcap_next_ex probably works is that it uses a static pointer to a struct pcap_pkthdr. In order for you to have a pointer to that struct in your function, you must pass a pointer to the pointer, so pcap_nex_ex can change the contents of your pointer and have that change exist after the function is done. This is how C does "pass by reference". That doesn't mean that you have to use a pointer in your struct pcbuffer. You can declare it as a plain struct pcap_pkthdr and memcpy into that struct. Currently, your code is borken. You don't malloc space for the pkt_header in your packets array, so they all just point to the same static piece of data in pcap_nex_ex. You need to malloc like you showed in post #7, or you need to make the pkt_header member of your struct pcbuffer a plain struct (not a pointer to struct). Your two options (untested, but I think you get the idea):
Code:
/* Packet capture buffer */
struct pcbuffer {
struct pcap_pkthdr *pkt_header;
u_char *pkt_data;
int length;
};
typedef struct pcbuffer packet_capture;
packet_capture packets[PC_BUFFERSIZE];
struct pcap_pkthdr *pkt_header; /* I defined it as a pointer */
...
pcap_next_ex(phandle, &pkt_header, &pkt_data);
...
// we have a pointer, but it doesn't point to a valid object, so malloc space for it
packets[in].pkt_header = malloc(sizeof(*(packets[in].pkt_header)));
memcpy(packets[in].pkt_header, pkt_header, sizeof(*(packets[in].pkt_header)));
or
Code:
/* Packet capture buffer */
struct pcbuffer {
struct pcap_pkthdr pkt_header; // note, no pointer, a plain struct
u_char *pkt_data;
int length;
};
typedef struct pcbuffer packet_capture;
packet_capture packets[PC_BUFFERSIZE];
struct pcap_pkthdr *pkt_header; // still a pointer
...
pcap_next_ex(phandle, &pkt_header, &pkt_data); // this still requires a pointer to a pointer, hence &pkt_header
...
// no need for malloc, we have space for the object since it's a struct and not a pointer
memcpy(&packets[in].pkt_header, pkt_header, sizeof(packets[in].pkt_header));