Here is some information about jNetPcap internals, how it works and how classes related to each other. This is not intended for typical user use, but for developers that need to know how the library functions internally.
There are 2 parts to jNP, the libpcap wrapper and the packet decoding framework. The libpcap wrapper doesn't have much logic, it truely is just a wrapper that takes java calls and via the "native" modifier on java method, binds JNI (Java Native Interface) code to java code.
Static methods, have not persistent state and simply query some kind of global pcap function. Instance methods such as the ones in Pcap and WinPcap classes that first require pcap handle to be acquired, store the pcap structure's physical address in a private field in Pcap class. This field is retrieved everytime an instance method is invoked and converted to a memory pointer. Type cast to appropriate structure and used in the original native call. The result is returned and that all there is too it. All libpcap wrapper function work that way. There is very little other logic at JNI level for libpcap wrapper functions. Exceptions are findAllDevs method which converts a linked list of pcap_if structures to a java list. The same goes for addresses retrieved from those structures.
Then we get to packet decoding framework. This is everything under org.jnetpcap.packet package.