libpcap packet size

Question

I'm working with libpcap in C on linux (centos) and I'm following this guide I want to simply print out the entire packet in ascii and i'v managed to get it working by casting it a u_char* in the "my_callback" function. But I can't figure out how to get the length of the data. strstr didn't work. the header has a len member that you can access to get the size but I can't find anything similar for the *packet being passed. Any help is appreciated.

Answer 1

In your callback the caplen member of the pkthdr variable (see struct pcap_pkthdr) contains the size of the captured packet.

For example assume a packet is captured. The total length of the frame is 1024 bytes. However the capture driver only captured the first 128 bytes of the frame and made it available to your callback.

In this case you should expect pkthdr->caplen to be 128 and header->len to be 1024.