[Winpcap-users] Can I capture inbound packets only?

[Loris Degioanni]

Guy Harris wrote:

> 
> If you're now using Linux, and you have libpcap 0.9.x, you can just use 
> "pcap_setdirection()" to specify that you only want incoming packets
> 
>     pcap_setdirection(p, PCAP_D_IN);
> 
> This works regardless of whether you're capturing on the "any" device or 
> not.
> 
> It also works on BSD systems.  It doesn't work on any other platforms 
> (including Windows; I don't know whether a future WinPcap release will 
> implement it or not).
> 

Guy, can you explain me the semantic of pcap_setdirection()? When you 
say that you only capture incoming packets, do you mean at the NIC level 
(i.e. you only get the packets that the interface card receives) or at 
the pcap adapter level (i.e. you don't get the packets that open pcap 
adapter is transmitting)?

The latter is implementable in winpcap, while the former requires 
direction information that the Windows kernel, as far as I know, just 
doesn't provide.

Loris