In libpcap 1.10.5, two structures that we rely on, pcap_timeval and
pcap_sf_pkthdr, were made private. As a workaround, we initially
defined the structures in pflogd.h. After further investigation, mostly
by kp@, we concluded that it is reasonable to define these structures
ourselves since they represent a file format and thus are unlikely to
change from under us. We will stick with this solution but move the
definitions out of the header file to prevent others from using pflogd.h
to access them.
Another solution that was considered was using libpcap's pcap_dump()
function to write packets, but there are blockers. For example, pflogd
writes to a memory buffer, and libpcap lacks support for this.