Thanks, I am starting to get the hang of it. One last problem
remains(I hope).


This struct is giving me fits

struct pcap_pkthdr {
	struct timeval ts;	/* time stamp */
	bpf_u_int32 caplen;	/* length of portion present */
	bpf_u_int32 len;	/* length this packet (off wire) */
};


A pointer of this gets passed into: const u_char*  pcap_next(pcap_t *,
struct pcap_pkthdr *);

attach_function :pcap_next,[:pointer,:pointer],:pointer

I can apparently get caplen and len without issue, but the timeval
field is reported as a pointer and any attempt to get at it results in
a seg fault.


ph_ptr = FFI::MemoryPointer.new :pointer,Header::Pcap_pkthdr.size,true
pack=Header::Pcap_pkthdr.new ph_ptr
pack[:ts]=TimeStamp::Timeval.new
packet=Pcap::pcap_next @pcap_ptr,pack
raise "no packet read" if packet.null?

puts pack[:ts] #pointer object

packet is not null, so it appears the packet is read properly(I
haven't laid out the various header and payload structures yet.