In the past documentation (from winpcap 3.0) it was outlined the importance of dumping the packet to disk in kernel mode, without have to switch from kernel to user and viceversa for every packet dumped. In the 3.0 and 3.1 versions pcap_live_dump isn't working. What about Winpcap 4 and pcap_live_dump ? ciao, Massimo ITALY