Re: pcap_next_ex calls pcap_oneshot instead of p->oneshot_callback

[Guy Harris <guy () alum mit edu>]

On Feb 4, 2011, at 5:00 AM, Tobias C Rittweiler wrote:

> In the latest release as well as git HEAD, pcap_next_ex
> calls pcap_oneshot (the default callback) instead of
> p->oneshot_callback like pcap_next does.
>
> This means that packets change underneath one application
> when using Linux and its mmapped ring buffer.

I've checked a fix into the trunk and the 1.1 branch.

> Additionally, I think the manpages of pcap_next and
> pcap_dispatch should describe whether or not the user
> is supposed the free the packet's memory. My understanding
> is that the packet has dynamic extent in case of pcap_dispatch
> but in case of pcap_next / pcap_next_ex the user is supposed to
> free the packet buffer -- is that correct?

No.  The packet buffer is allocated by libpcap, and is attached to the pcap_t.  It's guaranteed (with the above fix) 
not to change until either pcap_loop(), pcap_dispatch(), pcap_next(), or pcap_next_ex() is called.

I've updated the man pages to reflect the lifetime of the packet header and packet data.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.