Thank you! I appreciate your help.

On Oct 20, 10:57 pm, Wayne Meissner <wmeiss...@gmail.com> wrote:

> Off the top of my head, that one should be laid out something like:
>
> class Pcap_pkthdr< FFI::Struct
>   layout :ts, TimeStamp::Timeval.by_value,
>      :caplen, :int,
>      :len, :int
> end
>
> The important bit is the ".by_value" bit - that makes the Pcap_pkthdr
> struct include the Timeval struct inline, not a pointer to it.
>
> Then you can just use it as normal:
> pack=Header::Pcap_pkthdr.new ph_ptr
>
> # Note, you don't need to create an instance of Timeval, as
> Pcap_pkthdr contains one inline.
> pack[:ts][:tv_sec] = 0xcafebeef
> pack[:ts][:tv_usec] = 0xfee1dead
>
> On 21 October 2010 13:58, Qwerty <qwerty123451...@hotmail.com> wrote:
>

> > Thanks, I am starting to get the hang of it. One last problem
> > remains(I hope).

>

> > This struct is giving me fits

>

> > struct pcap_pkthdr {
> >        struct timeval ts;      /* time stamp */
> >        bpf_u_int32 caplen;     /* length of portion present */
> >        bpf_u_int32 len;        /* length this packet (off wire) */
> > };

>

> > A pointer of this gets passed into: const u_char*  pcap_next(pcap_t *,
> > struct pcap_pkthdr *);

>

> > attach_function :pcap_next,[:pointer,:pointer],:pointer

>

> > I can apparently get caplen and len without issue, but the timeval
> > field is reported as a pointer and any attempt to get at it results in
> > a seg fault.

>

> > ph_ptr = FFI::MemoryPointer.new :pointer,Header::Pcap_pkthdr.size,true
> > pack=Header::Pcap_pkthdr.new ph_ptr
> > pack[:ts]=TimeStamp::Timeval.new
> > packet=Pcap::pcap_next @pcap_ptr,pack
> > raise "no packet read" if packet.null?

>

> > puts pack[:ts] #pointer object

>

> > packet is not null, so it appears the packet is read properly(I
> > haven't laid out the various header and payload structures yet.