RES: [Winpcap-users] Mirroring and winpcap

Gianluca Varenni gianluca.varenni at
Mon Aug 29 16:03:58 GMT 2005

Uhm... stupid question: are you sure you are choosing the right adapter with 
pcap_open (in your l_Device variable)?

Have you tried to use of the samples of WinPcap and see if they work?

Have a nice day

----- Original Message ----- 
From: "Cristian Gallas" <cristian.gallas at>
To: "'Guy Harris'" <guy at>
Cc: <winpcap-users at>
Sent: Sunday, August 28, 2005 8:35 PM
Subject: RES: RES: [Winpcap-users] Mirroring and winpcap

> > Look the code, the only reference I use to brings
> promiscuous mode, is
> >the [1] on parameter to pcap_open, if need do something difference,
> >maybe is my mistake.
> >
> >      FAdapter := pcap_open(PChar(l_Device),
> >        WTAP_MAX_PACKET_SIZE, // Capture entire packet //
> >        1, // Promiscuous mode      //
> >        20, // Read timeout          //
> >        @l_auth, // Autenticação remota   //
> >        @errbuf);
> >
> >
> The WinPcap documentation seems to suggest that your call
> should be putting the adapter into promiscuous mode.
> However, there are two differences between the call you're
> making and the call Ethereal makes:
>     1) Ethereal calls pcap_open_live(), not pcap_open();
>     2) the code that Ethereal uses to call pcap_open_live() is in C.
> Either of those might be the cause of the problem you're seeing.

I already change to pcap_open_live and the problem is the same, is
so strange, my program works perfect, the problem persist only when computer
has two active adapters, and second adapter receive a mirror.

Thanx be the same

Winpcap-users mailing list
Winpcap-users at

More information about the Winpcap-users mailing list