Re: error executing ksniff with libpcap 1.0.0

[Giovanni Venturi <giovanni () ksniffer org>]

Alle lunedì 17 novembre 2008, Guy Harris ha scritto:
> On Nov 16, 2008, at 1:28 PM, Giovanni Venturi wrote:
> > Hello,
> > I'm the author of ksniffer a GUI interface under KDE 3 to capture
> > network
> > packet.
> > Till libpcap < 1.0.0 (the last stable you released) all was ok in
> > the packet
> > capture, but now I get the following error message:
>
> This appears to be a duplicate of your earlier message; see my recent
> reply to the last message you sent (summary: pcap_next() is a
> troublesome API as it can return NULL even if no error has occurred;
> pcap_next_ex() is better, or you could try using pcap_dispatch()
> directly).
> -
As man says:

pcap_next_ex() returns 1 if the packet was read without problems, 0 if packets 
are being read from a live capture, and the timeout expired, -1 if an error 
occurred while reading the packet, and -2 if packets are being read from a 
``savefile'', and there are no more packets to read from the savefile. If -1 
is returned, pcap_geterr() or pcap_perror() may be called with p as an 
argument to fetch or display the error text. 


Can someone explain me this?

int result = 9;
result = pcap_next_ex(m_pcapfp, &hdr, (const u_char **)&p);

Sometimes I get 9, sometimes I get 1, ...

How can it be possible that the return value doesn't change result variable? 
This is a big mistery. Reading man I undestood that pcap_next_ex() return:

1 or 0 or -1 or -2 and nothing else.

This 1.0.0 is quite buggy on Linux?
Giovanni

-- 
A KDE Italian translator and KSniffer core developer
Slackware GNU/Linux current version - kernel 2.6.27.6
KSniffer Project - http://www.ksniffer.org/

Attachment: signature.asc
Description: This is a digitally signed message part.