pcap struct pcap_pkthdr len vs caplen

Your understanding is correct, at least based on the pcap man page.

caplen is the amount of data available to you in the capture. len was the actual length of the packet.

I’m not aware of any cases that would give you a caplen > len. I usually seem them being equal as my snaplen is sufficiently high.

Leave a Comment

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)