live capture Ethernet gives me zero-packets

[Andrej van der Zee <andrejvanderzee () gmail com>]

Hi,

I am trying to get started with a live capture using libpcap. Somehow I
cannot get the contents of a packet. It seems that all bytes are zeroed.
Here is the source code:

#include <pcap.h>
#include <stdio.h>
#include <stdlib.h>

void callback(u_char * user, const struct pcap_pkthdr* pkthdr, const u_char
* pkt)
{
  fprintf(stdout, "caplen=%d, pkt[12]=%d, pkt[13]=%d\n", pkthdr->caplen,
pkt[12], pkt[13]);
}

int main(int argc,char **argv)
{
  char errbuf[PCAP_ERRBUF_SIZE];
  pcap_t * pd;

  if(NULL == (pd = pcap_open_live("any", BUFSIZ, 1, 0, errbuf)))
  {
    printf("pcap_open_live(): %s\n", errbuf);
    exit(1);
  }

  pcap_loop(pd, -1, callback, NULL);

  return 0;
}

Output is like this:

caplen=1416, pkt[12]=0, pkt[13]=0
caplen=56, pkt[12]=0, pkt[13]=0
caplen=1416, pkt[12]=0, pkt[13]=0
caplen=1416, pkt[12]=0, pkt[13]=0
.... etc ....

I am running Ubuntu Maverick 64bit with kernel 2.6.35-28-generic. Note that
reading from a savefile works just fine, so my guess it has something to do
with memory mapping between kernel and user space.

Thank you,
Andrej
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.