<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2><FONT face="Times New Roman" size=3>Our application
is to read "raw" (layer 2 type) Ethernet packets being transmitted from
proprietary hardware to the host computer. We are using Winpcap 3.1. The
code used to initialize is given below:</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2></FONT></FONT> </DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2> if ((adhandle[i-1]=
pcap_open_live(d->name, // name of the
device<BR> 65536, //
portion of the packet to capture.
<BR> // 65536
grants that the whole packet will be captured on all the
MACs.<BR> 1, //
promiscuous mode (nonzero means
promiscuous)<BR>
10, // read
timeout<BR> errbuf //
error buffer<BR> )) ==
NULL)<BR> {<BR> MessageBox(NULL,"Unable to open the
adapter","d->name",MB_OK);<BR> /* Free the device list
*/<BR> pcap_freealldevs(alldevs);<BR> Errorcode=1;<BR> return
Errorcode;<BR> }</FONT></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2> /*****Sets the Kernel
buffer to 512000 bytes*****/ </FONT></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial
size=2> if(pcap_setbuff(adhandle[i-1],512000)
==-1) {<BR> MessageBox(NULL,"Error in
pcap_setbuff","d->name",MB_OK);<BR> pcap_close(adhandle[i-1]);<BR> Errorcode=1;<BR> return
Errorcode;<BR> }</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2> /*****Sets the filter
to accept only broadcast packets *****/<BR> if (mode == 1 )//broadcast
mode<BR> {</FONT></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial
size=2> if(pcap_compile(adhandle[i-1], &fcode, "ether broadcast",
1, 0xffffff) <
0)<BR> {<BR> Errorcode=1;<BR> pcap_close(adhandle[i-1]);<BR> return
Errorcode;<BR> }</FONT></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2> //set the
filter<BR> if(pcap_setfilter(adhandle[i-1],
&fcode)<0)<BR> {<BR> pcap_close(adhandle[i-1]);<BR> Errorcode=1;<BR> return
Errorcode;<BR> <BR> }</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2></FONT></FONT> </DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2></FONT></FONT> </DIV>
<DIV><FONT face=Arial size=2>pcap_next_ex is used to read packets.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The program works for 10-12 days and then it seems
that receive operation stops. Once the program is closed and started again,
everything is OK.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Is there a possibility that recive stops when
kernel buffer reaches the end ?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Regards</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Lancy Thomas</FONT></DIV>
<DIV><FONT face=Arial size=2> </DIV>
<DIV><BR></DIV></FONT><BR><PRE>
______________________________________
Scanned and protected by Email scanner
</pre><BR>
</BODY></HTML>