struct pcap_pkthdr len always == zero

Without copying all of the source in here, I am hitting a pcap_callback function from pcap_dispatch. The caplen seems to show the correct length (being that it is always something) but the len always equals 0. Is this field no longer populated? Is this maybe an error condition I am not capturing?

Here is a snippet...

void myCallback ( const struct pcap_pkthdr *header, const u_char *packet, void* buffer )
{
   if ( (uint16_t)(header->len) != (uint16_t)(header->caplen) )
       /* Some Error */
        streamObj << "Caplen (" <<  (uint16_t)(header->caplen) <<  " != "
        << ") Packet Len (" << (uint16_t)(header->len) << ")";
   ...
}

The header->len value always comes b开发者_开发百科ack as zero. If more info is needed, just let me know.

This was found on a SUSE Linux 11SP1 server running libpcap.so.0.9.8 with a 2.6.32 kernel. The issue is only present after upgrading from SUSE Linux 10SP3 with libpcap.so.0.9.3.

EDIT: This appears to only be an issue with libpcap.so.0.9.8. I repointed the link in /usr/lib/ to use libpcap.so.0.9.3 and the problem disappeared.

The three arguments to a callback function for pcap_dispatch() are, in order:

1. The "user data" pointer passed to pcap_dispatch();
2. A pointer to a struct pcap_pkthdr;
3. A pointer to the raw packet data.

Therefore, myCallback is not a valid callback function, and can't be passed to pcap_dispatch(), as it's expecting the first argument to be the pointer to the struct pcap_pkthdr. Unless you have another function that's the real callback, which then calls myCallback with the appropriate arguments, the code in question won't work, and should get at least a warning from a C or C++ compiler.