Re: libpcap pcap_stats() integer wrap in struct pcap_stat u_int

[Guy Harris <guy () alum mit edu>]

On Jan 6, 2011, at 4:38 PM, Brandon Enright wrote:

> I haven't yet looked at the implementation of pcap_stats() or
> pcap_stats_ex() but is it possible to make pcap_stats_ex() available on
> Unix (specifically recent x86_64 Linux kernels)?

In principle, yes.

pcap_stats_ex() does, however, have some problems:

        1) it only gives you 64-bit counters in LP64 or LLP64 code;

        2) not all the fields can necessarily be filled in on all devices on all platforms - although that's a problem 
even with pcap_stats();

        3) there's no way for the caller to say "I only care about these fields, don't waste any time fetching the 
others" - that's also a problem with pcap_stats();

so what would be better would be a call that, for example, takes a list of statistics to fetch, using pcap-ng option 
codes, and fills in something that looks like the option list for a pcap-ng Interface Statistics Block:

        http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionisb

with additional option codes added to pcap-ng for the additional statistics, and all statistics being 64 bit.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.