<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16441" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=samsaw7@yahoo.com href="mailto:samsaw7@yahoo.com">Samir Sawhney</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, May 07, 2007 2:00 AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Question about
operation of pcap_next_ex () innon-blocking mode...</DIV>
<DIV><BR></DIV>
<DIV>Hello,<BR><BR>I am using the winpcap 4.0 library to send and receive
<BR>TCP/IP packets to/from a demo application running on a <BR>Windows 2000/XP
computer.<BR><BR>From an earlier post, I learnt that setting the
<BR>'read_timeout' parameter of pcap_open () to -1 causes <BR>pcap_next_ex ()
to exhibit non-blocking behavior.<BR><BR>In such a (non-blocking)
configuration, what are the <BR>parameters that determine when packets are
copied out from <BR>the kernel buffers into the user buffers (where they can
be <BR>retrieved via the pcap_next_ex () call)? </DIV>
<DIV><FONT size=2></FONT> </DIV></BLOCKQUOTE>
<DIV><FONT size=2>pcap_next_ex becomes a polling function: it will return
immediately, even if there are no available packets. It's something that
you definitely want to avoid if possible.</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV><FONT size=2></FONT> </DIV>
<DIV>Is the <BR>pcap_setmintocopy () call still relevant in such a
(non-<BR>blocking) configuration? </DIV>
<DIV><FONT size=2></FONT> </DIV></BLOCKQUOTE>
<DIV><FONT size=2>the mintocopy value is not relevant as far as pcap_next_ex()
is concerned. It's still in use if you obtain the read event handle
(pcap_getevent()), and wait on it before receiving packets. This event gets
signalled when at least mintocopy bytes are available in the kernel capture
buffer.</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV> What role does the <BR>PCAP_OPENFLAG_MAX_RESPONSIVENESS flag
(specified in the <BR>'flags' parameter in the call to pcap_open ())
play?</DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2></FONT> </DIV></BLOCKQUOTE>
<DIV><FONT size=2>PCAP_OPENFLAG_MAX_RESPONSIVENESS sets the mintocopy value to
0. If you set a mintocopy to 0 and a timeout > 0, pcap_next_ex() will block
until the timeout elapses or at least one packet has been
received.</FONT></DIV><FONT size=2></FONT>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px"><FONT
size=2></FONT>
<DIV><BR><BR>Also, one of the papers at this site talks about an API<BR>call
to set the size of the user buffer. However, I<BR>wasn't able to find
any such function in the WinPcap<BR>documentation. Can you please point
me to the relevant<BR>function?<BR></DIV><FONT size=2></FONT></BLOCKQUOTE>
<DIV><FONT size=2>The function is called pcap_setuserbuffer() (int
pcap_setuserbuffer(pcap_t *p, int size)). It's exported by WinPcap but it has
never been documented.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV><FONT size=2></FONT> </DIV>
<DIV><BR>Thanks,<BR><BR>Samir</DIV>
<P>
<HR SIZE=1>
8:00? 8:25? 8:40? <A
href="http://tools.search.yahoo.com/shortcuts/?fr=oni_on_mail&#news">Find
a flick</A> in no time<BR>with the<A
href="http://tools.search.yahoo.com/shortcuts/?fr=oni_on_mail&#news">Yahoo!
Search movie showtime shortcut.</A>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>