reading header

[styve]

Hi! I'm recieving packets with pcap_next and store them to a file with pcap_dump. To double check I also copy the packet to a buffer and print the first five bytes at the console to see if they are the same as in the file. But they not. In the file the first packet come after 40 bytes. So I think it is the IP header 20 bytes + TCP header 20 bytes. Why are they not performed on the screen when I print them in the console? So I think, okey, then there will be 40 extra bytes for next paket too, but it is not. It is only 16 bytes??? and also next packet, and next ... Why is it 40 bytes for the first packet I recieve, and then 16 bytes for the packets I recieve after? Can someone explain this for a confused man, Stefan