Guy Harris

Perhaps libpcap should, for PPP DLT_ values that might or might not include the HDLC-like headers, generate BPF code that checks for the FF 03 and skips it if it's...

The generated BPF code doesn't handle protocol field compression either: ``` $ ./filtertest PPP ip (000) ldh [2] (001) jeq #0x21 jt 2 jf 3 (002) ret #68 (003) ret...

Time stamps for captured packets come from the OS's clocks or from network adapter clocks, not from libpcap itself. This means that this will require different changes for different platforms,...

> Until then, Npcap users will have to use the Npcap-specific pcap_setmode directly. Or indicate how this works and either 1) I can write the code and check in the...

> Thanks [@guyharris](https://github.com/guyharris) . We love how well you support libpcap and tcpdump! We have to do the 1.83 release imminently for unrelated reasons, so that's why we were only...

I've checked in some code that *should* work; it compiles with `PACKET_MODE_NANO` defined and with it not defined. It's the-tcpdump-group/libpcap@55ee807c9a8718766a8359a2a0e7d6f7170ac9d0, if you want to try it.

> I've checked in some code that _should_ work; it compiles with `PACKET_MODE_NANO` defined and with it not defined. > > It's [the-tcpdump-group/libpcap@55ee807](https://github.com/the-tcpdump-group/libpcap/commit/55ee807c9a8718766a8359a2a0e7d6f7170ac9d0), if you want to try it. You...

> Or limited to the normal Windows resolution of 100 nsec units I think that's all that the Npcap driver can ket from the NT executive. Providing an indication of...

> so people can use them in a clean way ...including the people who develop libpcap. I'm assuming that `PACKET_MODE_NANO` means "capture with nanosecond timestamp resolution" (or, at least, "with...

> If so, please submit an issue or a pull request for this to the libpcap repository, so we can be ready for it. I.e., #804.