Re: pcap_data vs payload

[Alokat <mailing () alokat org>]

On 07/10/11 00:53, Guy Harris wrote:
> On Jul 9, 2011, at 7:50 PM, Alokat wrote:
>
> > Just for sure:
> >
> > *Ethernet packet*
> >
> > means a layer 2 (OSI / ISO model) packet right?
> Yes.
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
Thanks for the answer,

just one more question.
If I just wanna get the data without the layer 2 stuff can I use
something like this:

payload = (u_char *)(packet + size_ip + size_tcp);

I do only need the data from layers 3 - 7.

Regards,
alokat

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.