<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Hi,<br>
<br>
This is possible if you use separate threads.<br>
Be sure that you leave your capture callback routine as soon as
possible, otherwise you will loose packets. (consider to use queues)<br>
Use Pcap_stats_ex (with a capture driver handle) to detect packet drops.<br>
<br>
On a given *single* adapter, i use pcap_open_live twice(for capturing)
and pcap_open twice(with to_ms=1000 and pcap_setmode for statistics
mode). The NPF filters can be set and altered at any time without
influencing the others.<br>
<br>
Regards<br>
Helmut<br>
</tt><br>
Emre Erişgen schrieb:
<blockquote
cite="mid:CAF8arNg_9sNVr4d0yHQTpFLv=Mh39iLDUKxzJS5p1ouwN34Ffg@mail.gmail.com"
type="cite">
<p class="MsoNormal">I want to explain my question a little bit more.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Is it doable to listen a device with 2 different
filters and
capture packets? For example i start listening a device with a filter
and
dumping the packets to a pcap file, after 15min can i start another
listen on
the same device with different filter and dump the packets to another
pcap file
without stopping the old one? </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Does pcap_open or pcap_next_ex block the
incoming packets?
What i mean if a packet arrives while listening from two different
threads one
of them will get the packet and control it for filter can the other
thread
access the packet? </p>
<p class="MsoNormal"> </p>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
Winpcap-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a>
<a class="moz-txt-link-freetext" href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</a>
</pre>
</blockquote>
</body>
</html>