Wireshark · Wireshark-users: [Wireshark-users] take over responsibility of the pcap_pkthdr *

[Andrej van der Zee <andrejvanderzee@xxxxxxxxx>]

Hi,

I have a question about the callback pcap_handler that is called for
each packet. I assume that each pcap_pkthdr * is released by pcap
after the callback returns. Is it by any means possible to take over
responsibility of the pcap_pkthdr *? Sometimes I want to write a
complete TCP stream to a file, but I only know this after having
handled a certain number of packets.

Thank you,
Andrej