<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Dear Victor,<div> Thank you for the in depth explanation. I have also gone to read on the pf_ring documentation on this </div><div><span style="font-size: 12pt;">int pfring_recv(pfring *ring, u_char** buffer, u_int buffer_len, struct pfring_pkthdr *hdr,</span><div>u_int8_t wait_for_incoming_packet) .</div><div><br></div><div><span style="font-size: 12pt;">1. Another thing can I say the pf_ring </span><span style="font-size: 12pt;">u_char** buffer is what your p is ?</span> </div><div>2. What does this represent <span style="font-size: 12pt;"> </span><span style="font-size: 12pt;">PacketGetFromQueueOrAlloc(); as I see you do a copy rite ? </span></div><div><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;"> 3.When say loop is referring to pfring_recv function right? What actually you are doing in </span>PfringProcessPacket ? </div><div><br></div><div>4. What about this GET_PKT_DIRECT_DATA and I saw this function memcpy(p->ext_pkt, GET_PKT_DIRECT_DATA(p), GET_PKT_DIRECT_MAX_SIZE(p)); ?</div><div><br></div><div>5. In short can I say that you get the buffer and do all the operatives first before your dissect process?</div><div><br></div><div>Sorry I have been traversing and kind of lost.</div><div>Thank you.</div><br><div><br></div></div> </div></body>
</html>