[Winpcap-users] winpcap and ip change

[Thorsten Stoffregen]

Hi david,

> > pcap_close(pcap_t ...);
> > changeIp(.....);
> > Sleep(5000);
> > pcap_open(pcap_t ...);
> 
> May open a new capture BEFORE you change the IP and read from BOTH
> streams during that 5 second period?
> 
> Then once the 5 seconds have passed, close the original stream and
> continue reading from only the new stream?

It doesn't work if I don't close the capture. Even when I 
close, wait and open the device within my software and wireshark is 
running and capturing on the same device, the capture stops, no
more packeges.
Only if I stop and restart wireshark capture and my application
after the change it will capture agein 
(took me a couple of hours, because wireshark is
running almost all the time while I'm testing...).


> Or maybe there's a way to change the IP address of the adapter WITHOUT
> using netsh? (Maybe there's a command (OID?) you can send to the
> adapter to assign a new IP without disabling/re-enabling
> (unbinding/rebinding) the adapter (which is what I believe netsh is
> probably doing))?? I haven't looked but there might be something
> better than netsh.
I tried netsh and the WMI command EnableStatic (with C#)

http://msdn.microsoft.com/en-us/library/aa390383%28v=VS.85%29.aspx

both methods shows the same behavior. If you now another better 
way to change the Ip please let me know. The hole application is
written in C (runs on Linux, VxWorks, Windows), 
only for the Ip change I used an mixed code
(managed/unmanaged) Dll to fire the WMI Command.

> "Gianluca Varenni" worte:
> In general, changing the IP address should not cause this effect (it's
> something inside the tcp/ip stack, WinPcap works in parallel with it).
> Unless the IP address change causes some changes in some NDIS intermediate
> driver (so below WinPcap) and there is some unbinding/binding going on.

Hm, maybe the "EnableStatic" command is causing the trouble, even if
DHCP is switched of all the time.