<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:"Malgun Gothic";
panose-1:2 11 5 3 2 0 0 2 0 4;}
@font-face
{font-family:"Microsoft JhengHei";
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@Malgun Gothic";
panose-1:2 11 5 3 2 0 0 2 0 4;}
@font-face
{font-family:"\@Microsoft JhengHei";
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
span.link-enhancr-element
{mso-style-name:link-enhancr-element;}
span.link-enhancr-view-on-domain
{mso-style-name:link-enhancr-view-on-domain;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:574975066;
mso-list-template-ids:26915910;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>The inverted call model might be useful in an abstract way to get notified of a media <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>state change, however, the question then comes back to how to convey that detail <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>to the application which is using the libpcap APIs. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Since the only APIs that an application which already has a pcap session opened <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>is using are: pcap_next_ex, pcap_dispatch, pcap_loop and possibly <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>pcap_sendpacket<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>pcap_next_ex, pcap_dispatch and pcap_loop are defined to return -1 on an error. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Is media state change an error?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> Is media offline an error?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>pcap_sendpacket is defined to return -1 if a packet wasn’t successfully sent.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> It would seem that returning -1 when the media is offline makes sense<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>I don’t know for sure how WinPcap behaves under these conditions, but it <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>seems that it npcap should reliably report errors under the media offline state.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Is there a reason it can’t?<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></a></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b>On Behalf Of </b>Jiyang Hu<br><b>Sent:</b> Thursday, February 4, 2016 11:18 AM<br><b>To:</b> winpcap-users@winpcap.org<br><b>Subject:</b> Re: [Winpcap-users] Windows 10 support for WinPcap<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div id="yui_3_16_0_1_1454042874573_209517"><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>@Sven: you need something called - Inverted Call Model<o:p></o:p></span></p></div><div id="yui_3_16_0_1_1454042874573_209516"><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div id="yui_3_16_0_1_1454042874573_209497"><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><a href="https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/">The Inverted Call Model in KMDF - OSR</a><br><br><o:p></o:p></span></p></div><div style='margin-top:3.75pt;margin-bottom:3.75pt' id="enhancrCard_0"><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=563 style='width:337.5pt;border-collapse:collapse'><tr style='height:.75pt'><td colspan=8 style='background:#E5E5E5;padding:0in 0in 0in 0in;height:.75pt'><div id="yui_3_16_0_1_1454042874573_209710"><p class=MsoNormal style='mso-line-height-alt:0pt;background:#E5E5E5'><span style='font-size:1.0pt'> <o:p></o:p></span></p></div></td></tr><tr style='height:4.5pt' id="yui_3_16_0_1_1454042874573_209708"><td width=1 rowspan=5 style='width:.75pt;background:#E5E5E5;padding:0in 0in 0in 0in;height:4.5pt'><div><p class=MsoNormal style='background:#E5E5E5'><span style='font-size:1.0pt'> <o:p></o:p></span></p></div></td><td width=210 rowspan=5 style='width:1.75in;background:white;padding:0in 0in 0in 0in;height:4.5pt' id="yui_3_16_0_1_1454042874573_210312"><p class=MsoNormal align=center style='text-align:center'><a href="https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/" id="yui_3_16_0_1_1454042874573_210310"><span style='border:solid windowtext 1.0pt;padding:0in;text-decoration:none'><img border=0 width=168 height=168 id="_x0000_i1036" src="cid:image001.jpg@01D15F42.F88F5BC0" alt="Image removed by sender. image"></span></a><o:p></o:p></p></td><td width=1 rowspan=5 style='width:.75pt;background:#E5E5E5;padding:0in 0in 0in 0in;height:4.5pt'><div><p class=MsoNormal style='background:#E5E5E5'><span style='font-size:1.0pt'> <o:p></o:p></span></p></div></td><td width=18 rowspan=5 style='width:10.5pt;background:white;padding:0in 0in 0in 0in;height:4.5pt'><div><p class=MsoNormal style='background:white'><span style='font-size:14.0pt'> <o:p></o:p></span></p></div></td><td colspan=2 style='background:white;padding:0in 0in 0in 0in;height:4.5pt' id="yui_3_16_0_1_1454042874573_209707"><div id="yui_3_16_0_1_1454042874573_209706"><p class=MsoNormal style='background:white'><span style='font-size:6.0pt'> <o:p></o:p></span></p></div></td><td width=25 rowspan=5 style='width:15.0pt;background:white;padding:0in 0in 0in 0in;height:4.5pt' id="yui_3_16_0_1_1454042874573_210367"><div><p class=MsoNormal style='background:white'><span style='font-size:20.0pt'> <o:p></o:p></span></p></div></td><td width=1 rowspan=5 style='width:.75pt;background:#E5E5E5;padding:0in 0in 0in 0in;height:4.5pt'><div><p class=MsoNormal style='background:#E5E5E5'><span style='font-size:1.0pt'> <o:p></o:p></span></p></div></td></tr><tr id="yui_3_16_0_1_1454042874573_209687"><td width="100%" colspan=2 style='width:100.0%;padding:0in 0in 0in 0in' id="yui_3_16_0_1_1454042874573_209686"><div id="yui_3_16_0_1_1454042874573_209685"><div id="yui_3_16_0_1_1454042874573_209684"><p class=MsoNormal style='line-height:12.4pt;background:white;word-break:break-all'><span style='font-family:"Georgia",serif'><a href="https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/"><span class=link-enhancr-element><span style='font-size:13.5pt;color:black;text-decoration:none'>The Inverted Call Model in KMDF - OSR</span></span></a><o:p></o:p></span></p><div><p class=MsoNormal style='line-height:15.0pt;background:white;word-break:break-all'><span style='font-size:10.0pt;font-family:"Georgia",serif;color:#999999'>One of the most common questions we see from students, clients, and new Windows driver Read more<o:p></o:p></span></p></div></div></div></td></tr><tr style='height:3.0pt'><td colspan=2 style='background:white;padding:0in 0in 0in 0in;height:3.0pt'></td></tr><tr><td style='padding:0in 0in 0in 0in'><div><p class=MsoNormal><span style='font-size:1.0pt;font-family:"Arial",sans-serif'><a href="https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/" target="_blank"><span class=link-enhancr-element><span style='font-size:7.0pt;color:#999999;text-decoration:none'>View on </span></span><span class=link-enhancr-view-on-domain><b><span style='font-size:7.0pt;color:#999999;text-decoration:none'>www.osr.com</span></b></span></a><o:p></o:p></span></p></div></td><td width=125 style='width:75.0pt;padding:0in 0in 0in 0in'><p class=MsoNormal align=right style='text-align:right;line-height:8.25pt'><span class=link-enhancr-element><span style='font-size:7.0pt;font-family:"Arial",sans-serif;color:#999999'>Preview by Yahoo</span></span><span style='font-size:1.0pt;font-family:"Arial",sans-serif'><o:p></o:p></span></p></td></tr><tr style='height:6.75pt'><td colspan=2 style='background:white;padding:0in 0in 0in 0in;height:6.75pt'></td></tr><tr style='height:.75pt'><td colspan=8 style='background:#E5E5E5;padding:0in 0in 0in 0in;height:.75pt'><div><p class=MsoNormal style='mso-line-height-alt:0pt;background:#E5E5E5'><span style='font-size:1.0pt'> <o:p></o:p></span></p></div></td></tr><tr height=0><td width=1 style='border:none'></td><td width=172 style='border:none'></td><td width=1 style='border:none'></td><td width=6 style='border:none'></td><td width=188 style='border:none'></td><td width=185 style='border:none'></td><td width=8 style='border:none'></td><td width=1 style='border:none'></td></tr></table></div><div id="yui_3_16_0_1_1454042874573_209497"><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt;background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><div><div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:black'>On Thursday, February 4, 2016 12:49 PM, Sven Kerschbaum <svkers@gmail.com> wrote:</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><p class=MsoNormal style='margin-bottom:12.0pt;background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p><div><div id=yiv2227248093><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>@Yang: It is not possible to get notifications of media state changes by the API which you proposed in your previous post. It provides only notifications about IP table changes.<o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>Am 04.02.2016 16:31 schrieb "Sven Kerschbaum" <<a href="mailto:svkers@gmail.com" target="_blank">svkers@gmail.com</a>>:<o:p></o:p></span></p><div id=yiv2227248093yqt23056><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>Hi Yang,<o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>thanks for providing me the detailed information about Npcap. I will definitively have a look at it and try it.<o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>Cheers,<o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>SK<o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>2016-02-04 13:04 GMT+01:00 </span><span style='font-family:"Malgun Gothic",sans-serif;color:black'>食肉大灰</span><span style='font-family:"Microsoft JhengHei",sans-serif;color:black'>兔</span><span style='font-family:"Helvetica",sans-serif;color:black'>V5 <<a href="mailto:hsluoyz@gmail.com" target="_blank">hsluoyz@gmail.com</a>>:<o:p></o:p></span></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>Hi Sven,<o:p></o:p></span></p><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>Npcap (<a href="https://github.com/nmap/npcap" target="_blank">https://github.com/nmap/npcap</a>) has better performance because of NDIS 6. It also has several new features:<o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>I actually didn't add a function about making user software </span><span style='font-size:9.5pt;font-family:"Helvetica",sans-serif;color:black'>getting notified about media state changes. From my knowledge I don't know there's any support of such a function in libpcap. libpcap is an interface standard followed by WinPcap/Npcap. However, I think you can do it using native Windows APIs (like Receiving Notification of Network Events in <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa366334(v=vs.85).aspx" target="_blank">https://msdn.microsoft.com/en-us/library/windows/desktop/aa366334(v=vs.85).aspx</a>). And if you have any improvement advice about Npcap, I will consider it:)</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:9.5pt;font-family:"Helvetica",sans-serif;color:black'>Cheers,</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:9.5pt;font-family:"Helvetica",sans-serif;color:black'>Yang</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div></div></blockquote></div></div></blockquote></div></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt;background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div></div></div></div></div></div></div></body></html>