Will the libpcap free the pcaket after pcap_next?
The packet is contained in a buffer internal to libpcap (attached to the pcap_t
); a new buffer is not allocated for each packet, so the buffer isn't freed after pcap_next()
, it's freed after the pcap_t
is closed. You do not have to free it yourself.
(This also means that the packet data from a particular call to pcap_next()
or pcap_next_ex()
is not guaranteed to remain valid after the next call to pcap_next()
or pcap_next_ex()
- or pcap_loop()
or pcap_dispatch()
; it might be overwritten with data from the next packet or the next batch of packets.)