What's pcap_pkthdr there for?

问题:

Code snippet from here:

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data) 
{ 
    .... 
    /* retireve the position of the ip header */ 
    ih = (ip_header *) (pkt_data + 
        14); //length of ethernet header 
    .... 

What's const struct pcap_pkthdr *header for(definition), when do we need it, how is it populated (since there is no such info in the packet itself as below)?

alt text http://www.dcs.gla.ac.uk/~lewis/networkpages/m04s03EthernetFrame_files/image002.gif

回答1:

If you would have kept the comment, it would have been a tad easier. It says:

/* Callback function invoked by libpcap for every incoming packet */

Here it says about typedef void(*) pcap_handler(u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data) :

pkt_header is the header associated by the capture driver to the packet. It is NOT a protocol header.