There are two ways to capture packets from an interface in libpcap. The first method is to ask libpcap for a packet at a time, and the second is to start a loop in libpcap that calls your callback function when packets are ready.

Ethereal uses a library called wiretap, which comes with the Ethereal source code, to read and write many packet analyzer file formats. Most people do not realize that Ethereal uses libpcap only for capturing packets. It does not use libpcap for reading pcap files. Ethereal's wiretap library reads pcap files. The reason wiretap reimplemented the pcap-reading code, is because wiretap has to read many variations of the pcap file format. There are various vendors that have modified the pcap format, sometimes without explicitly changing the version number inside the file.

The wiretap library currently supports 19 modules.

The GTK+ library and GIMP use the glib library, as does the GNOME desktop environment.

The tvbuff API ensures that the dissector can only read data that is there; if a dissector attempts to read beyond the boundary of the tvbuff, an exception is thrown and Ethereal shows a boundary error in the protocol tree for that packet.

The tvbuff that your dissector received contains only the data that your dissector is allowed to look at.

A tap module is the piece of code...