handle->md.stat.ps_recv = handle->md.kstats_total.tp_packets; handle->md.stat.ps_drop = handle->md.kstats_total.tp_drops;
handle->md.stat.ps_recv = kstats.tp_packets; handle->md.stat.ps_drop = kstats.tp_drops;
pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats){#ifdef HAVE_TPACKET_STATS	struct tpacket_stats kstats = {0};	socklen_t len = sizeof (struct tpacket_stats);#endif#ifdef HAVE_TPACKET_STATS	/*	 * Try to get the packet counts from the kernel.	 */	if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS,			&kstats, &len) > -1) {		/*		 * In "linux/net/packet/af_packet.c", at least in the		 * 2.4.9 kernel, "tp_packets" is incremented for every		 * packet that passes the packet filter *and* is		 * successfully queued on the socket; "tp_drops" is		 * incremented for every packet dropped because there's		 * not enough free space in the socket buffer.		 *		 * When the statistics are returned for a PACKET_STATISTICS		 * "getsockopt()" call, "tp_drops" is added to "tp_packets",		 * so that "tp_packets" counts all packets handed to		 * the PF_PACKET socket, including packets dropped because		 * there wasn't room on the socket buffer - but not		 * including packets that didn't pass the filter.		 *		 * In the BSD BPF, the count of received packets is		 * incremented for every packet handed to BPF, regardless		 * of whether it passed the filter.		 *		 * We can't make "pcap_stats()" work the same on both		 * platforms, but the best approximation is to return		 * "tp_packets" as the count of packets and "tp_drops"		 * as the count of drops.		 *		 * Keep a running total because each call to		 *    getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, ....		 * resets the counters to zero.		 */                /*                 * Keep a running total because each call to                 *    getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, ....                 * resets the counters to zero.                 */                handle->md.kstats_total.tp_packets += kstats.tp_packets;                handle->md.kstats_total.tp_drops += kstats.tp_drops;                handle->md.stat.ps_recv = handle->md.kstats_total.tp_packets;                handle->md.stat.ps_drop = handle->md.kstats_total.tp_drops;	}	else	{		/*		 * If the error was EOPNOTSUPP, fall through, so that		 * if you build the library on a system with		 * "struct tpacket_stats" and run it on a system		 * that doesn't, it works as it does if the library		 * is built on a system without "struct tpacket_stats".		 */		if (errno != EOPNOTSUPP) {			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,			    "pcap_stats: %s", pcap_strerror(errno));			return -1;		}                handle->md.stat.ps_drop = -1; /* 0 is just not the right answer */	}#endif	/*	 * On systems where the PACKET_STATISTICS "getsockopt()" argument	 * is supported on PF_PACKET sockets:	 *	 *	"ps_recv" counts only packets that *passed* the filter,	 *	not packets that didn't pass the filter.  This includes	 *	packets later dropped because we ran out of buffer space.	 *	 *	"ps_drop" counts packets dropped because we ran out of	 *	buffer space.  It doesn't count packets dropped by the	 *	interface driver.  It counts only packets that passed	 *	the filter.	 *	 *	Both statistics include packets not yet read from the	 *	kernel by libpcap, and thus not yet seen by the application.	 *	 * On systems where the PACKET_STATISTICS "getsockopt()" argument	 * is not supported on PF_PACKET sockets:	 *	 *	"ps_recv" counts only packets that *passed* the filter,	 *	not packets that didn't pass the filter.  It does not	 *	count packets dropped because we ran out of buffer	 *	space.	 *	 *	"ps_drop" is not supported.	 *	 *	"ps_recv" doesn't include packets not yet read from	 *	the kernel by libpcap.	 */	*stats = handle->md.stat;	return 0;}