CODEWITHSUNDEEP
cstructlibpcap
snowfox
snowfox

Reputation: 13

dereferencing pointer to incomplete type for pcap_t structure

I am coding in C and using libpcap library. I want to see the fields of a pcap_t structure, but always have the error :

error: dereferencing pointer to incomplete type

Minimal code is the following :

#include <stdio.h>
#include <pcap/pcap.h>

int main()
{
    char errbuf[PCAP_ERRBUF_SIZE];
    pcap_t *handle;
    handle=pcap_open_live("eth0", 65535, 1, 1, errbuf);

    printf("Handle%d\n", handle->fd);

    pcap_close(handle);
}

Compilation done by :

gcc test.c -lpcap

According to http://www.opensource.apple.com/source/libpcap/libpcap-9/libpcap/pcap-int.h, the pcap_t structure does have this field. The libpcap is normally included, so I do not understand at all.

Thanks!

Conclusion: Olaf seems to be right : I have this error because I am not able to access the pcap_t structure. As Antti Haapala said, pcap_t struct is not defined in pcap/pcap.h but in another file.

I did manage to do what I wanted to do anyway, even without access to the fields of the structure.

Problem solved, thanks for your help !

Upvotes: 1

Views: 733

Answers (2)

user862787
user862787

Reputation:

Well, you can do, instead, either

printf("Handle%d\n", pcap_fileno(handle));

if you're not going to use select()/poll()/epoll()/kqueues/etc. on the descriptor in question, or

if (pcap_get_selectable_fd(handle) != -1)
    printf("Handle%d\n", pcap_get_selectable_fd(handle));

if you are going to use select()/poll()/epoll()/kqueues/etc. on the descriptor in question.

The difference is that, at least currently, there will always be a file descriptor for a pcap_t on UN*Xes, but there is no guarantee that you will be able to use select()/poll()/epoll()/kqueues/etc. on that descriptor. On newer versions of BSD-flavored OSes (including OS X), you can do so on descriptors for normal network interfaces, but you can't do so on some older versions of BSD-flavored OSes, and you have to work around an issue on other older versions of BSD-flavored OSes (see the man page for pcap_get_selectable_fd() for details), and you also can't do so on some specialized devices such as Endace DAG cards.

So, in some cases, pcap_get_selectable_fd() returns -1, which means "there is no FD on which you can do select(), etc., for this pcap_t".

(And, yes, it is intentional that pcap-int.h is not installed and that pcap.h doesn't declare the members of a struct pcap_t; the contents of that structure are subject to change from release to release, and newer libpcap releases have removed a lot of platform-dependent and device-dependent fields from that structure.)

Upvotes: 0

Antti Haapala -- Слава Україні
Antti Haapala -- Слава Україні

Reputation: 133859

the -int in pcap-int.h stands for internal. However you're not including this header in your code.

Notice that pcap.h itself does not include this header, neither does it contain a full declaration of struct pcap; instead just using the forward declaration in typedef:

typedef struct pcap pcap_t;

Just try:

#include <stdio.h>
#include <pcap/pcap-int.h>
#include <pcap/pcap.h>

int main()
{
    char errbuf[PCAP_ERRBUF_SIZE];
    pcap_t *handle;
    handle=pcap_open_live("eth0", 65535, 1, 1, errbuf);

    printf("Handle%d\n", handle->fd);

    pcap_close(handle);
}

Alas it seems that this internal header is not installed in Linux nor on Mac. For an extra-ugly hack you can try copying the pcap-int.h from the link.

Upvotes: 1

Related Questions