<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2963" name=GENERATOR>
<STYLE>@font-face {
font-family: OCR A Extended;
}
@page Section1 {size: 612.0pt 792.0pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.EmailStyle17 {
COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal-compose
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-US vLink=purple link=blue bgColor=#ffffff>
<DIV><FONT size=2>I think that the marshalling you are doing with
P/Invoke is wrong.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>I haven't tried it myself, but you should
probably</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>1. declare the dlt_buf parameter as "ref IntPtr" (or out
IntPtr)</FONT></DIV>
<DIV><FONT size=2>2. call pcap_list_datalinks</FONT></DIV>
<DIV><FONT size=2>3. create a managed int array of size "result" </FONT></DIV>
<DIV><FONT size=2>4. use Marshal.Copy(<A
href="ms-help://MS.MSDNQTR.2003OCT.1033/cpref/html/frlrfsystemintptrclasstopic.htm"><FONT
size=3>IntPtr</FONT></A><FONT size=3><B> </B><I><A class=synParam
onclick=showTip(this) href="">source</A></I><B>,</B></FONT><A
href="ms-help://MS.MSDNQTR.2003OCT.1033/cpref/html/frlrfsystemint32classtopic.htm"><FONT
size=3>int</FONT></A><FONT size=3><B>[] </B><I><A class=synParam
onclick=showTip(this) href="">destination</A></I><B>,</B></FONT><A
href="ms-help://MS.MSDNQTR.2003OCT.1033/cpref/html/frlrfsystemint32classtopic.htm"><FONT
size=3>int</FONT></A><FONT size=3><B> </B><I><A class=synParam
onclick=showTip(this) href="">startIndex</A></I><B>,</B></FONT><A
href="ms-help://MS.MSDNQTR.2003OCT.1033/cpref/html/frlrfsystemint32classtopic.htm"><FONT
size=3>int</FONT></A></FONT><FONT size=3><B> </B><A class=synParam
onclick=showTip(this) href=""><EM>length</EM></A><STRONG>) to copy from the
unmanaged pointer dlt_buf to the managed int array.</STRONG><BR></FONT></DIV>
<DIV><FONT size=3><FONT size=2>Have a nice day</FONT></FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV><FONT size=3><FONT size=2></FONT> </DIV></FONT>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=steve.a.beaudoin@gmail.com
href="mailto:steve.a.beaudoin@gmail.com">Steve Beaudoin</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Thursday, August 24, 2006 5:32
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users]
Pcap_list_datalinks return bad number of links.</DIV>
<DIV><BR></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Hi,<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
I am developing a winpcap library in C# with visual studio 2005 (and using the
version 3.1 of winpcap) and the pcap_list_datalinks function return the value
2, indicating the number of datalinks it found, but the array return only one
element. <o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
I declared the import with this :<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; BACKGROUND: white; FONT-FAMILY: 'OCR A Extended'">
<FONT color=green><SPAN style="COLOR: green">// WinPCap : int
pcap_list_datalinks(pcap_t *p, int
**dlt_buf)<o:p></o:p></SPAN></FONT></SPAN></FONT></P>
<P class=MsoNormal><FONT face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; BACKGROUND: white; FONT-FAMILY: 'OCR A Extended'">
[<FONT color=teal><SPAN style="COLOR: teal">DllImport</SPAN></FONT>(<FONT
color=maroon><SPAN
style="COLOR: maroon">"wpcap.dll"</SPAN></FONT>,CharSet=<FONT color=teal><SPAN
style="COLOR: teal">CharSet</SPAN></FONT>.Ansi)]<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; BACKGROUND: white; FONT-FAMILY: 'OCR A Extended'">
<FONT color=blue><SPAN style="COLOR: blue">internal</SPAN></FONT> <FONT
color=blue><SPAN style="COLOR: blue">extern</SPAN></FONT> <FONT
color=blue><SPAN style="COLOR: blue">static</SPAN></FONT> <FONT
color=blue><SPAN style="COLOR: blue">int</SPAN></FONT>
pcap_list_datalinks(<FONT color=teal><SPAN
style="COLOR: teal">IntPtr</SPAN></FONT> pcapT, <FONT color=blue><SPAN
style="COLOR: blue">ref</SPAN></FONT> <FONT color=blue><SPAN
style="COLOR: blue">int</SPAN></FONT>[] dlt_buf);</SPAN></FONT><FONT
face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; FONT-FAMILY: 'OCR A Extended'"><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; FONT-FAMILY: 'OCR A Extended'"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
And the code to retrieve the links is :<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; BACKGROUND: white; FONT-FAMILY: 'OCR A Extended'">
<FONT color=teal><SPAN style="COLOR: teal">IntPtr</SPAN></FONT>
pcapT=OpenDevice(Target,Auth);<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; BACKGROUND: white; FONT-FAMILY: 'OCR A Extended'">
<FONT color=blue><SPAN style="COLOR: blue">int</SPAN></FONT>[] links=<FONT
color=blue><SPAN style="COLOR: blue">new</SPAN></FONT> <FONT color=blue><SPAN
style="COLOR: blue">int</SPAN></FONT>[] {};<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face="OCR A Extended" size=1><SPAN
style="FONT-SIZE: 8pt; BACKGROUND: white; FONT-FAMILY: 'OCR A Extended'">
<FONT color=blue><SPAN style="COLOR: blue">int</SPAN></FONT> result=<FONT
color=teal><SPAN
style="COLOR: teal">NativeMethods</SPAN></FONT>.pcap_list_datalinks(pcapT,<FONT
color=blue><SPAN style="COLOR: blue">ref</SPAN></FONT>
links);</SPAN></FONT><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> <o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
The value return into result is 2, but the links array only have one value (1
for Ethernet).<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
The detailed information returned by ethereal for the same network adapter
(path : capture->interfaces->details) return only one media supported (I
suppose this is the name they use for datalink).<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
I first thought it was because I used 32bits integer for my array, but the
symptoms are the same with 16bits bytes.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
So, either the returned value is wrong, or I’m missing a datalink in my array,
or I’m doing something wrong in the code.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
Someone have an idea before I dig into the winpcap source
code?<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>