How the pcap_next_ex() method is filling the pcp_pkthdr structure passing as input at driver level?

Question

I am using pcap file in my application. I need to know , how the pcap_next_ex() API is filling the pcap_pkt header structure.In header we are having timeval structure, how API are filling this timeval structure?

Thankyou

Answer 1

It's filling the structure by copying data that the kernel provides to it. Libpcap runs atop various packet capture mechanisms in various OSes, and WinPcap runs atop its kernel-mode driver in Windows. Those mechanisms provide time stamps to libpcap, and the kernel-mode driver provides them to WinPcap.