pcap why always packets of 8 bytes... why?

I'm using the pcap library but I don't know why I get always this output:

new packet with size: udata= 8 hdr=8 pkt=8

This is the code:

void handle_pcap(u_char *udata, const struct pcap_pkthdr *hdr, const u_char *pkt)
{
  DEBUG("DANY new packet with size: udata= %d hdr=%d pkt=%d", (int) sizeof(udata),(int) sizeof(hdr),(int) sizeof(pkt) );
...
stuff
}

and in another file I use:开发者_开发知识库

status = pcap_loop (pcap_obj,
    -1     /* How many packets it should sniff for before returning (a negative value
       means it should sniff until an error occurs  (loop forever) ) */,
    handle_pcap  /* Callback that will be called*/,
    NULL   /* Arguments to send to the callback (NULL is nothing) */);

Is it normal that output?

I think not because sometimes my program works sometimes doesn't..

---

You are printing the size of the pointers instead of looking into the pcap_pkthdr* hdr to see the size of the packet.

You can find the size of the captured data and the size of the entire packet by looking at hdr->caplen and hdr->len.

---

Um. You are getting the size of (the various) pointers.

e.g. sizeof(udata) gets the size of a u_char *. That's why the numbers look suspect.

If you want the sizes of the packets, they are in hdr->caplen and hdr->len (the former is the captured length, the latter is the packet length).