Off the top of my head, that one should be laid out something like:


class Pcap_pkthdr< FFI::Struct
  layout :ts, TimeStamp::Timeval.by_value,
     :caplen, :int,
     :len, :int
end

The important bit is the ".by_value" bit - that makes the Pcap_pkthdr
struct include the Timeval struct inline, not a pointer to it.

Then you can just use it as normal:
pack=Header::Pcap_pkthdr.new ph_ptr

# Note, you don't need to create an instance of Timeval, as
Pcap_pkthdr contains one inline.
pack[:ts][:tv_sec] = 0xcafebeef
pack[:ts][:tv_usec] = 0xfee1dead


On 21 October 2010 13:58, Qwerty <qwerty123451910@hotmail.com> wrote:

> Thanks, I am starting to get the hang of it. One last problem
> remains(I hope).
>
>
> This struct is giving me fits
>
> struct pcap_pkthdr {
>        struct timeval ts;      /* time stamp */
>        bpf_u_int32 caplen;     /* length of portion present */
>        bpf_u_int32 len;        /* length this packet (off wire) */
> };
>
>
> A pointer of this gets passed into: const u_char*  pcap_next(pcap_t *,
> struct pcap_pkthdr *);
>
> attach_function :pcap_next,[:pointer,:pointer],:pointer
>
> I can apparently get caplen and len without issue, but the timeval
> field is reported as a pointer and any attempt to get at it results in
> a seg fault.
>
>
> ph_ptr = FFI::MemoryPointer.new :pointer,Header::Pcap_pkthdr.size,true
> pack=Header::Pcap_pkthdr.new ph_ptr
> pack[:ts]=TimeStamp::Timeval.new
> packet=Pcap::pcap_next @pcap_ptr,pack
> raise "no packet read" if packet.null?
>
> puts pack[:ts] #pointer object
>
> packet is not null, so it appears the packet is read properly(I
> haven't laid out the various header and payload structures yet.
>
>