Re: Buffer overwrites with pcap_next_ex

[Guy Harris <guy () alum mit edu>]

On Jan 24, 2009, at 11:01 AM, Guy Harris wrote:

> No.  pcap_next_ex() returns a pointer to a packet header and a  
> pointer to packet data.
>
> These are, in fact, pointers to a structure internal to libpcap and  
> a buffer internal to libpcap, respectively

Make that "a pointer to a structure internal to libpcap and a pointer  
*into* a buffer internal to libpcap"; depending on the OS on which  
you're running, and on the packet capture paths it offers, that buffer  
might, or might not, hold more than one packet, and a given read  
might, or might not, overwrite anything in the buffer.  (*Eventually*  
a read will overwrite the buffer, once you've read all the packets in  
the buffer.)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.