On Oct 2, 2010, at 3:32 PM, Sake Blok wrote:
> Ah... thank you for pointing me to capture-wpcap.c, I was not aware of the intermediate layer to WinPcap.
Yes - we load WinPcap at run time; that dates back to before we bundled it with Wireshark, so we could ship a single binary that worked, without capture support, if you didn't have WinPcap installed and that worked, with capture support, if you did. capture-wpcap.c is a bunch of wrappers that call through pointers fetched from the run-time-loaded WinPcap.
Note, BTW, that older versions of libpcap have neither pcap_compile_nopcap() nor pcap_open_dead(). I can dig up the full history (I have the impression that some versions of NetBSD have a pcap_compile_nopcap() with an extra argument, for example) at some point.
