[Winpcap-users] Pcap_list_datalinks return bad number of links.

Gianluca Varenni gianluca.varenni at cacetech.com
Thu Aug 24 16:33:39 GMT 2006

I think that the marshalling you are doing with P/Invoke is wrong.

I haven't tried it myself, but you should probably

1. declare the dlt_buf parameter as "ref IntPtr" (or out IntPtr)
2. call pcap_list_datalinks
3. create a managed int array of size "result" 
4. use Marshal.Copy(IntPtr source,int[] destination,int startIndex,int length) to copy from the unmanaged pointer dlt_buf to the managed int array.

Have a nice day

  ----- Original Message ----- 
  From: Steve Beaudoin 
  To: winpcap-users at winpcap.org 
  Sent: Thursday, August 24, 2006 5:32 AM
  Subject: [Winpcap-users] Pcap_list_datalinks return bad number of links.



              I am developing a winpcap library in C# with visual studio 2005 (and using the version 3.1 of winpcap) and the pcap_list_datalinks function return the value 2, indicating the number of datalinks it found, but the array return only one element.  


              I declared the import with this :


           // WinPCap : int pcap_list_datalinks(pcap_t *p, int **dlt_buf)


           internal extern static int pcap_list_datalinks(IntPtr pcapT, ref int[] dlt_buf);


              And the code to retrieve the links is :


              IntPtr pcapT=OpenDevice(Target,Auth);

              int[] links=new int[] {};

              int result=NativeMethods.pcap_list_datalinks(pcapT,ref links); 


              The value return into result is 2, but the links array only have one value (1 for Ethernet).


              The detailed information returned by ethereal for the same network adapter (path : capture->interfaces->details) return only one media supported (I suppose this is the name they use for datalink).


              I first thought it was because I used 32bits integer for my array, but the symptoms are the same with 16bits bytes.


              So, either the returned value is wrong, or I'm missing a datalink in my array, or I'm doing something wrong in the code.


              Someone have an idea before I dig into the winpcap source code?



  Winpcap-users mailing list
  Winpcap-users at winpcap.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20060824/2ec5f9e0/attachment.htm

More information about the Winpcap-users mailing list