<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16587" name=GENERATOR></HEAD>
<BODY>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>I am wrining an app to capture various multicast
streams to seperate files.</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>In order to make my program easier to write I have 1
thread per stream, and</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>open the NIC card multiple times and pull out
the packets and filter them</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>in my code using src/dst ip addresses. This appears to
work great, but</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>a bit CPU intensive. </SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>I thought it might be easier then to use the winpcap
filter function, so I wrote</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>a bit of code to do this and that initially appeared to
work great, BUT</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>on further investigation, it would appear that winpcap
only uses the last</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>filter that was set with pcap_setfilter.
i.e.</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>if I have three threads and in in each one I
open an instances of my port and</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>in each thread set a filter on each one (eg
thread 1 = 'dst ip 225.0.0.1', </SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>thread 2 = 'dst ip 225.0.0.2', thread
3 = 'dst ip 225.0.0.3'), then start calling</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>pcap_next_ex() in each thread, all three threads will
only receive packets</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>matching 'dst ip
225.0.0.3'</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008></SPAN></SPAN></STRONG> </DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>Is this "as designed"?, any ideas for a workaround, or
is it back to filtering</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>in my software?</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008></SPAN></SPAN></STRONG> </DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>TIA</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008></SPAN></SPAN></STRONG> </DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>Paul</SPAN></SPAN></STRONG></DIV>
<BR>
_______________________________________________________________________<BR>
This e-mail has been scanned for all viruses by Star Internet. The<BR>
service is powered by MessageLabs.<BR>
_______________________________________________________________________<BR>
</BODY></HTML>