There shouldn't be a difference, technically that is. 1.x differs greatly though in functionality, but is backwards compat with 1.x. A few years ago I did a 2.x conversion for some very old code:Âhttps://github.com/ellzey/trafan/blob/master/trafan.cÂwith pcap.and *many* many years ago I did this which never moved out to 2.x, completely 1.0. But it still works with old/new pcap and libevent as seen here:ÂBut mind you, pcap_dispatch with -1 means you may be processing a ton of packets, all of which call your pcap callback. ÂÂ