pcap struct pcap_pkthdr len vs caplen

Question

We\'re sniffing packets using libpcap on linux The header we get on each packet looks like:

struct pcap_pkthdr {
        struct timeval ts;      /* time stamp */         


        

Answer 1

If caplen > len, that's a bug; what version of libpcap are you using?