<div dir="ltr">Dear Guy and Gianluca,<div><br></div><div>thank you very much for prompt reply; with you suggested correction it worked perfectly on all platforms.</div><div><br></div><div>Keep up the amazing work.</div><div>
<br></div><div>Br,</div><div>Ciao,</div><div><br></div><div>\Carlo<br><br><div class="gmail_quote">On Fri, Sep 19, 2008 at 9:44 PM, Guy Harris <span dir="ltr"><<a href="mailto:guy@alum.mit.edu">guy@alum.mit.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="Ih2E3d"><br>
On Sep 19, 2008, at 9:40 AM, Gianluca Varenni wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
snaplen is used only if you use a capture filter, as the snaplen feature is implemented as a filter. This is the standard behavior of snaplen on libpcap/winpcap.<br>
</blockquote>
<br></div>
...at least on *BSD, Mac OS X, and Windows. In Linux, the return value of the BPF filter program isn't treated as a snapshot length, and, on some other platforms, the BPF filter isn't even handed to the kernel - in those cases, the snapshot length is supplied elsewhere, which is why the snapshot length might happen to work without a capture filter on Linux when it doesn't work on Windows (or *BSD or Mac OS X).<div class="Ih2E3d">
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
If you want to use snaplen and you don't need a filter, please compile an empty filter (i.e. the string "").<br>
</blockquote>
<br></div>
Yes. This, arguably, should be fixed, so that, if a snapshot length < 65535 is specified, and no capture filter is specified, a trivial BPF program (ret {snapshot length}) is installed with BPF and WinPcap.<div><div>
</div><div class="Wj3C7c"><br>
_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
</div></div></blockquote></div><br></div></div>