libpcap will sometimes, depending upon the interface chosen, replace the layer 2 header (ethernet, in this case) with a Linux cooked header which does not have the same length as an ethernet header. You can check the datalink type of your pcap_t
with the pcap_datalink
function.
unsigned int layer_2_header_length;
switch ( pcap_datalink(handle) ) {
case DLT_EN10MB: // Ethernet header
layer_2_header_length = 14;
break;
case DLT_LINUX_SLL: // Linux cooked header
layer_2_header_length = 16;
break;
// other options
}
CLICK HERE to find out more related problems solutions.