the correct way to use pcap_next_ex or pcap_next (libpcap)

Question

I saw this kind of code used in a project:

while (1) { l_numPkts = pcap_next_ex( m_pcapHandle, &header, &pkt_data); //do something memcpy(dst,pkt_data,size);
}

after the pcap_next_ex return,the packet status will be set TP_STATUS_KERNEL,which means the buf was return to kernel. code:

/* next packet */ switch (handle->md.tp_version) { case TPACKET_V1: h.h1->tp_status = TP_STATUS_KERNEL; ..

in some high speed environment,will it get a memory problem?

and what is the correct way to use pcap_next / pcap_next_ex?

Answer 1

There are lots of examples of working pcap examples online and helpful man pages. Try here: TCPDUMP.org We would need more of your code to answer your questions.