title: Measuring upload/download rates with libpcap
body: <p>I'm using libpcap (and winpcap on Windows) in a C application to monitor network traffic. I need to differentiate between upload and download traffic on each network adapter, to produce connection speed stats, but the filter expressions used by the library don't seem to support this very easily (ie there are no 'incoming'/'outgoing' operators). </p>
  
  <p>One approach that I have considered is to query the IP address of each adapter, and then use filters such as <code>src host 1.2.3.4</code> (to measure uploads) and <code>dst host 1.2.3.4</code> (to measure downloads).</p>
  
  <p>My questions are: </p>
  
  <p>Is there a better/simpler approach than the one above (something that would let me use the same filter expression for each adapter would be nice)?</p>
  
  <p>If the above approach is the way to go, then is there any chance that a single adapter could have more than 1 IP address associated with it? The reason I ask is that the <code>pcap_addr</code> struct which holds the address details of a single adapter (in <code>struct pcap_if</code>) has a 'next' member suggesting that this is possible.</p>