pcap captured length

Challenge

Read the captured-length field from a pcap per-packet record header — the count that tells you how many bytes follow before the next record.

Task

Implement unsigned pcap_incl_len(const unsigned char *rec) that returns incl_len, the little-endian 32-bit value at offset 8.

Input

• rec: a byte buffer (at least 16 bytes) holding one pcap record header. The header is four little-endian 32-bit fields in order: ts_sec, ts_usec, incl_len, orig_len. The grader passes a fixed buffer.

Output

Returns unsigned: the incl_len field assembled from rec[8..11], low byte first.

Example

rec[8..11] = 0x40 0x01 0x00 0x00
pcap_incl_len(rec)   ->   0x140

Edge cases

• Build the value byte-by-byte with shifts; do not cast the pointer (alignment-unsafe).

Input format

A byte buffer rec of at least 16 bytes (a pcap record header).

Output format

An unsigned: the LE32 incl_len field at offset 8.

Constraints

incl_len is the LE32 at offset 8. Assemble from bytes; no pointer casts.

Starter code

unsigned pcap_incl_len(const unsigned char *rec) {
    /* TODO */
    return 0;
}