Hi,<div><br></div><div>I think this api provides the callback. It's called network list manager:<div><a href="https://msdn.microsoft.com/en-us/library/ee264321(v=vs.85).aspx">https://msdn.microsoft.com/en-us/library/ee264321(v=vs.85).aspx</a></div>I don't how much you care latency, If you want Npcap to tell you the status change, it should be slower than the above way. Because driver has no way to call a user mode app, except the above mentioned invoke thing, but it sounds complicated.. So you have to get notified by calling pcap next function or by ioctl periodically. But they are not real time.</div><div><br></div><div>Btw, I didn't do the experiment, but could anyone tell me how Npcap actually behaves as network state changes? Is there obviously wrong reaction there?</div><div><br></div><div>Cheers,</div><div>Yang<br><div><br><br>On Saturday, February 6, 2016, Sven Kerschbaum <<a href="mailto:svkers@gmail.com">svkers@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">I cannot find any information about the function IoctlNdisQueryGlobalStats(...). Do you have a link? I agree that is not an option to query the media state in a loop. I have a working solution using WMI but the notification is not in real-time. I sometimes experience a delay of a few seconds... </p>
<div style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px"><div dir="ltr"><span style="font-family:'times new roman','new york',times,serif;font-size:medium;text-indent:47.20000076293945px">I believe query NDIS for </span><span style="font-family:'times new roman','new york',times,serif;font-size:medium;text-indent:47.20000076293945px"><font>OID_GEN_MEDIA_CONNECT_STATUS is a waste of resource if it is put in a loop. Getting a notification of media state change asynchronously should be better. My 2 cents.</font></span></div><div><br><br></div><div style="display:block"> <div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px"> <div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px"> <div dir="ltr"><font size="2" face="Arial"> On Friday, February 5, 2016 9:23 AM, Nuno Antonio Dias Ferreira <<a href="javascript:_e(%7B%7D,'cvml','nuno.ferreira@efacec.com');" target="_blank">nuno.ferreira@efacec.com</a>> wrote:<br></font></div> <br><br> <div><div><div>
<div>
<div><span lang="EN-US" style="font-size:11.0pt">Hi Sven,</span></div>
<div><span lang="EN-US" style="font-size:11.0pt"> </span></div>
<div><span lang="EN-US" style="font-size:11.0pt">I have an application where I am using npcap and I also have the need to detect the media status changes. To do that I
query NDIS to get that information: <a rel="nofollow" shape="rect">
https://msdn.microsoft.com/en-us/library/windows/hardware/ff569604(v=vs.85).aspx</a></span></div>
<div><span lang="EN-US" style="font-size:11.0pt"> </span></div>
<div><span lang="EN-US" style="font-size:11.0pt">Here is an example:</span></div>
<div style="text-indent:35.4pt"><span lang="EN-US" style="font-size:10.0pt">if</span><span lang="EN-US" style="font-size:10.0pt">(IoctlNdisQueryGlobalStats(Iface->IOCTLhandler,
OID_GEN_MEDIA_CONNECT_STATUS, &ConnectedState, <span style="color:blue">sizeof</span>(ConnectedState), (PUINT)&ReturnedCount) == ERROR_SUCCESS)</span></div>
<div><span lang="EN-US" style="font-size:10.0pt">
</span><span style="font-size:10.0pt">{</span></div>
<div><span style="font-size:10.0pt">
<span style="color:blue">return</span> ConnectedState == NdisMediaStateConnected;</span></div>
<div><span style="font-size:10.0pt"> }</span></div>
<div><span style="font-size:10.0pt"> </span></div>
<div><span lang="EN-US" style="font-size:11.0pt">Hope this information could be helpful.</span></div>
<div><span lang="EN-US" style="font-size:10.0pt"> </span></div>
<div><span lang="EN-US" style="font-size:10.0pt"> </span></div>
<div><span style="font-size:8.0pt">Melhores Cumprimentos / Best Regards</span></div>
<div><span style="font-size:8.0pt">Nuno Antonio Dias Ferreira<br clear="none">
Unidade de Automação de Sistemas de Energia / Power System Automation Unit</span></div>
<div><span style="font-size:8.0pt">Efacec Energia, Máquinas e Equipamentos Elétricos, S.A.<br clear="none">
</span><span style="font-size:11.0pt"><img border="0" width="107" height="44" src="cid:EcVGai9fPisXKd7YGTkS" alt="EFA Logo"></span><span style="font-size:8.0pt"></span></div>
<div><span lang="EN-US" style="font-size:8.0pt"><a rel="nofollow" shape="rect" title="Disclaimer Efacec">Disclaimer</a></span></div>
<div><span style="font-size:11.0pt"> </span></div>
<div><div><b><span lang="EN-US" style="font-size:11.0pt">From:</span></b><span lang="EN-US" style="font-size:11.0pt"> <a href="javascript:_e(%7B%7D,'cvml','winpcap-users-bounces@winpcap.org');" target="_blank">winpcap-users-bounces@winpcap.org</a> [mailto:<a href="javascript:_e(%7B%7D,'cvml','winpcap-users-bounces@winpcap.org');" target="_blank">winpcap-users-bounces@winpcap.org</a>]
<b>On Behalf Of </b>?????V5<br clear="none">
<b>Sent:</b> 5 de fevereiro de 2016 04:44<br clear="none">
<b>To:</b> <a href="javascript:_e(%7B%7D,'cvml','winpcap-users@winpcap.org');" target="_blank">winpcap-users@winpcap.org</a><br clear="none">
<b>Subject:</b> Re: [Winpcap-users] Windows 10 support for WinPcap</span></div>
<div> </div>
<div>
<div> </div>
<div>
<div> </div>
<div>
<div>On Fri, Feb 5, 2016 at 3:56 AM, Mark Pizzolato - Winpcap-Users <<a rel="nofollow" shape="rect">winpcap-users-20040408@subscriptions.pizzolato.net</a>> wrote:</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div><span lang="EN-US" style="font-size:11.0pt">The inverted call model might be useful in an abstract way to get notified of a media
</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">state change, however, the question then comes back to how to convey that detail
</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">to the application which is using the libpcap APIs.
</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">Since the only APIs that an application which already has a pcap session opened
</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">is using are: pcap_next_ex, pcap_dispatch, pcap_loop and possibly
</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">pcap_sendpacket</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">pcap_next_ex, pcap_dispatch and pcap_loop are defined to return -1 on an error.
</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">Is media state change an error?</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt"> Is media offline an error?</span><span lang="EN-US"></span></div>
</div>
</div>
</blockquote>
<div>
<div> </div>
</div>
<div>
<div>I prefer to use the phrases in ncpa.cpl.</div>
</div>
<div>
<div>If the adapter disconnects (like Wi-Fi), libpcap API should only report time-out (you don't get any new packets).</div>
</div>
<div>
<div>If the adapter is disabled, libpcap API may report error (or time-out)? I didn't try this. One thing for sure is that you can't get new packets too. This thing should not happen when using Npcap/WinPcap. Because when listing adapters with
Npcap/WinPcap, disabled adapters never show up on the list. So Npcap/WinPcap assumes that the adapters it uses is always kept as enabled.</div>
</div>
<div>
<div> </div>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">pcap_sendpacket is defined to return -1 if a packet wasn’t successfully sent.</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt"> It would seem that returning -1 when the media is offline makes sense</span><span lang="EN-US"></span></div>
</div>
</div>
</blockquote>
<div>
<div> </div>
</div>
<div>
<div>This makes sense to me.</div>
</div>
<div>
<div> </div>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">I don’t know for sure how WinPcap behaves under these conditions, but it
</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">seems that it npcap should reliably report errors under the media offline state.</span><span lang="EN-US"></span></div>
<div><span lang="EN-US" style="font-size:11.0pt">Is there a reason it can’t?</span><span lang="EN-US"></span></div>
</div>
</div>
</blockquote>
<div>
<div> </div>
</div>
<div>
<div>Npcap actually doesn't report errors any better than WinPcap. There's even a chance that Npcap behaves different on reporting errors with WinPcap. Because Npcap uses NDIS6 and WinPcap uses NDIS5.</div>
</div>
<div>
<div> </div>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div><a rel="nofollow" shape="rect"><span lang="EN-US" style="font-size:11.0pt"> </span></a><span lang="EN-US"></span></div>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<div><b><span lang="EN-US" style="font-size:11.0pt">From:</span></b><span lang="EN-US" style="font-size:11.0pt">
<a rel="nofollow" shape="rect">winpcap-users-bounces@winpcap.org</a> [mailto:<a rel="nofollow" shape="rect">winpcap-users-bounces@winpcap.org</a>]
<b>On Behalf Of </b>Jiyang Hu<br clear="none">
<b>Sent:</b> Thursday, February 4, 2016 11:18 AM<br clear="none">
<b>To:</b> <a rel="nofollow" shape="rect">winpcap-users@winpcap.org</a><br clear="none">
<b>Subject:</b> Re: [Winpcap-users] Windows 10 support for WinPcap</span><span lang="EN-US"></span></div>
</div>
</div>
<div><span lang="EN-US"> </span></div>
<div>
<div>
<div style="background:white">
<span lang="EN-US">@Sven: you need something called - Inverted Call Model</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="margin-bottom:12.0pt;background:white">
<span lang="EN-US"><a rel="nofollow" shape="rect">The Inverted Call Model in KMDF - OSR</a></span><span lang="EN-US"></span></div>
</div>
<div style="margin-top:3.75pt;margin-bottom:3.75pt">
<table border="0" cellspacing="0" cellpadding="0" width="450" style="width:337.5pt;border-collapse:collapse"><tbody><tr style="height:.75pt"><td colspan="8" rowspan="1" style="background:#e5e5e5;padding:0cm 0cm 0cm 0cm;height:.75pt">
<div>
<div style="background:#e5e5e5">
<span style="font-size:1.0pt"> </span></div>
</div>
</td></tr><tr style="height:4.5pt"><td colspan="1" rowspan="5" width="1" style="width:.75pt;background:#e5e5e5;padding:0cm 0cm 0cm 0cm;height:4.5pt">
<div>
<div style="background:#e5e5e5">
<span style="font-size:1.0pt"> </span></div>
</div>
</td><td colspan="1" rowspan="5" width="168" style="width:126.0pt;background:white;padding:0cm 0cm 0cm 0cm;height:4.5pt">
<div align="center" style="text-align:center">
<a rel="nofollow" shape="rect"><span style="border:solid windowtext 1.0pt;padding:0cm;text-decoration:none"><img border="0" width="168" height="168" src="cid:SSKFhVsy5S2dcr9Uxyw1" alt="Image removed by sender. image"></span></a></div>
</td><td colspan="1" rowspan="5" width="1" style="width:.75pt;background:#e5e5e5;padding:0cm 0cm 0cm 0cm;height:4.5pt">
<div>
<div style="background:#e5e5e5">
<span style="font-size:1.0pt"> </span></div>
</div>
</td><td colspan="1" rowspan="5" width="14" style="width:10.5pt;background:white;padding:0cm 0cm 0cm 0cm;height:4.5pt">
<div>
<div style="background:white">
<span style="font-size:14.0pt"> </span></div>
</div>
</td><td colspan="2" rowspan="1" style="background:white;padding:0cm 0cm 0cm 0cm;height:4.5pt">
<div>
<div style="background:white">
<span style="font-size:6.0pt"> </span></div>
</div>
</td><td colspan="1" rowspan="5" width="20" style="width:15.0pt;background:white;padding:0cm 0cm 0cm 0cm;height:4.5pt">
<div>
<div style="background:white">
<span style="font-size:20.0pt"> </span></div>
</div>
</td><td colspan="1" rowspan="5" width="1" style="width:.75pt;background:#e5e5e5;padding:0cm 0cm 0cm 0cm;height:4.5pt">
<div>
<div style="background:#e5e5e5">
<span style="font-size:1.0pt"> </span></div>
</div>
</td></tr><tr><td colspan="2" rowspan="1" width="100%" style="width:100.0%;padding:0cm 0cm 0cm 0cm">
<div>
<div>
<div style="line-height:12.4pt;background:white">
<span><a rel="nofollow" shape="rect"><span style="font-size:13.5pt;color:black;text-decoration:none">The Inverted Call Model in KMDF - OSR</span></a></span></div>
<div>
<div style="line-height:15.0pt;background:white">
<span style="font-size:10.0pt">One of the most common questions we see from students, clients, and new Windows driver Read more</span></div>
</div>
</div>
</div>
</td></tr><tr style="height:3.0pt"><td colspan="2" rowspan="1" style="background:white;padding:0cm 0cm 0cm 0cm;height:3.0pt"></td></tr><tr><td colspan="1" rowspan="1" style="padding:0cm 0cm 0cm 0cm">
<div>
<div><span style="font-size:1.0pt"><a rel="nofollow" shape="rect"><span style="font-size:7.0pt;color:#999999;text-decoration:none">View
on <b>www.osr.com</b></span></a></span></div>
</div>
</td><td colspan="1" rowspan="1" width="100" style="width:75.0pt;padding:0cm 0cm 0cm 0cm">
<div align="right" style="text-align:right;line-height:8.25pt">
<span style="font-size:7.0pt">Preview by Yahoo</span></div>
</td></tr><tr style="height:6.75pt"><td colspan="2" rowspan="1" style="background:white;padding:0cm 0cm 0cm 0cm;height:6.75pt"></td></tr><tr style="height:.75pt"><td colspan="8" rowspan="1" style="background:#e5e5e5;padding:0cm 0cm 0cm 0cm;height:.75pt">
<div>
<div style="background:#e5e5e5">
<span style="font-size:1.0pt"> </span></div>
</div>
</td></tr><tr><td colspan="1" rowspan="1" width="1" style="width:.75pt;padding:0cm 0cm 0cm 0cm"></td><td colspan="1" rowspan="1" width="172" style="width:129.0pt;padding:0cm 0cm 0cm 0cm"></td><td colspan="1" rowspan="1" width="1" style="width:.75pt;padding:0cm 0cm 0cm 0cm"></td><td colspan="1" rowspan="1" width="6" style="width:4.5pt;padding:0cm 0cm 0cm 0cm"></td><td colspan="1" rowspan="1" width="188" style="width:141.0pt;padding:0cm 0cm 0cm 0cm"></td><td colspan="1" rowspan="1" width="185" style="width:138.75pt;padding:0cm 0cm 0cm 0cm"></td><td colspan="1" rowspan="1" width="8" style="width:6.0pt;padding:0cm 0cm 0cm 0cm"></td><td colspan="1" rowspan="1" width="1" style="width:.75pt;padding:0cm 0cm 0cm 0cm"></td></tr></tbody></table>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="margin-bottom:12.0pt;background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div>
<div>
<div>
<div style="background:white">
<span lang="EN-US" style="font-size:10.0pt">On Thursday, February 4, 2016 12:49 PM, Sven Kerschbaum <<a rel="nofollow" shape="rect">svkers@gmail.com</a>> wrote:</span><span lang="EN-US"></span></div>
</div>
<div style="margin-bottom:12.0pt;background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
<div>
<div>
<div>
<div>
<div style="background:white">
<span lang="EN-US">@Yang: It is not possible to get notifications of media state changes by the API which you proposed in your previous post. It provides only notifications about IP table changes.</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US">Am 04.02.2016 16:31 schrieb "Sven Kerschbaum" <<a rel="nofollow" shape="rect">svkers@gmail.com</a>>:</span><span lang="EN-US"></span></div>
<div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<div style="background:white">
<span lang="EN-US">Hi Yang,</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US">thanks for providing me the detailed information about Npcap. I will definitively have a look at it and try it.</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US">Cheers,</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US">SK</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
<div>
<div style="background:white">
<span lang="EN-US">2016-02-04 13:04 GMT+01:00
</span><span>食肉大灰</span><span>兔</span><span lang="EN-US">V5 <<a rel="nofollow" shape="rect">hsluoyz@gmail.com</a>>:</span><span lang="EN-US"></span></div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div style="background:white">
<span lang="EN-US">Hi Sven,</span><span lang="EN-US"></span></div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US">Npcap (<a rel="nofollow" shape="rect">https://github.com/nmap/npcap</a>) has better performance because of NDIS 6. It also has several new features:</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US">I actually didn't add a function about making user software </span><span lang="EN-US" style="font-size:9.5pt">getting notified about media
state changes. From my knowledge I don't know there's any support of such a function in libpcap. libpcap is an interface standard followed by WinPcap/Npcap. However, I think you can do it using native Windows APIs (like Receiving Notification of Network Events
in <a rel="nofollow" shape="rect">https://msdn.microsoft.com/en-us/library/windows/desktop/aa366334(v=vs.85).aspx</a>). And if you have any improvement advice about Npcap, I will consider
it:)</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US" style="font-size:9.5pt">Cheers,</span><span lang="EN-US"></span></div>
</div>
<div>
<div style="background:white">
<span lang="EN-US" style="font-size:9.5pt">Yang</span><span lang="EN-US"></span></div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
<div style="margin-bottom:12.0pt;background:white">
<span lang="EN-US"> </span><span lang="EN-US"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div style="margin-bottom:12.0pt"><br clear="none">
_______________________________________________<br clear="none">
Winpcap-users mailing list<br clear="none">
<a rel="nofollow" shape="rect">Winpcap-users@winpcap.org</a><br clear="none">
<a rel="nofollow" shape="rect">https://www.winpcap.org/mailman/listinfo/winpcap-users</a></div>
</blockquote>
</div>
<div> </div>
</div>
</div></div>
</div>
</div></div><br><div>_______________________________________________<br clear="none">Winpcap-users mailing list<br clear="none"><a shape="rect">Winpcap-users@winpcap.org</a><br clear="none"><a shape="rect">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br clear="none"></div><br><br></div> </div> </div> </div></div></div><br>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="javascript:_e(%7B%7D,'cvml','Winpcap-users@winpcap.org');" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
<br></div>
</blockquote></div></div>