[Winpcap-users] RE: Multi-threaded application with mutiple pcap
instances
Tal Cohen
talc10 at hotmail.com
Tue Oct 24 12:39:14 GMT 2006
Hi,
Unfortunately I can't duplicate the send packet error is my environment. It
is only happen on production environment; therefore I'm not allowed to
change the winpacap from ver 3.1 to 4.
Thanks,
Tal
>From: winpcap-users-request at winpcap.org
>Reply-To: winpcap-users at winpcap.org
>To: winpcap-users at winpcap.org
>Subject: Winpcap-users Digest, Vol 19, Issue 20
>Date: Tue, 24 Oct 2006 12:00:36 GMT
>
>Send Winpcap-users mailing list submissions to
> winpcap-users at winpcap.org
>
>To subscribe or unsubscribe via the World Wide Web, visit
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>or, via email, send a message with subject or body 'help' to
> winpcap-users-request at winpcap.org
>
>You can reach the person managing the list at
> winpcap-users-owner at winpcap.org
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of Winpcap-users digest..."
>
>
>Today's Topics:
>
> 1. Re: Suppressed Packets (Peter Hegel)
> 2. Re: ANNOUNCE: WinPcap 4.0 beta2 has been released
> (Gianluca Varenni)
> 3. Re: Multi-threaded application with mutiple pcapinstances
> (Gianluca Varenni)
> 4. Re: It took 27 seconds to call pcap_open_live. Isit ok?
> (Gianluca Varenni)
>
>
>----------------------------------------------------------------------
>
>Message: 1
>Date: Mon, 23 Oct 2006 16:36:41 +0200
>From: Peter Hegel <peter.hegel at doli.de>
>Subject: Re: [Winpcap-users] Suppressed Packets
>To: winpcap-users at winpcap.org
>Message-ID: <453CD379.7060506 at doli.de>
>Content-Type: text/plain; charset=ISO-8859-15; format=flowed
>
> > It seems as though the D-Link card drops packets whole Ethertype/Len is
> > > 46, i.e. packets declaring an ethernet payload size greater than
> > 46--> total packet size > 60. You are actually transmitting 60-byte
> > packets, so it's possible that the DLINK network card discards those
> > "truncated" packets.
> >
> > Have you tried transmitting bigger packets (say 200 bytes) and see what
> > happens? I guess the dlink card will receive only the packets with
> > Ethertype/len < 186 (200-14) bytes.
>Changing the length to 200 bytes didn't realy help. Packets with length
>0 to 2D and one with length BA (200-14) were received.
>
>Playing with different lengt fields showed that the D-LINK driver drops
>packetes with 'invalid' length fields. Valid means that the length field
>specifies the number of data bytes (or is less than 46).
>
>Changing sendpack.c to the following code works with the D-LINK driver,
>too:
>
> for(i=0; i<150; i++)
> {
> /* set packet size to min. 60 bytes */
> if( i < 60 ) j = 60;
> else j = i;
>
> /* set 802.3 length field (packet len - header len) */
> packet[12]=(j-14)/0x100;
> packet[13]=(j-14)%0x100;
>
> /* send down the packet */
> if (pcap_sendpacket(fp, packet, j) != 0)
> return 3;
> }
>
> > Hope it helps
>Thank you, it helped a lot!
>
>Peter
>
>
>------------------------------
>
>Message: 2
>Date: Mon, 23 Oct 2006 08:59:01 -0700
>From: "Gianluca Varenni" <gianluca.varenni at cacetech.com>
>Subject: Re: [Winpcap-users] ANNOUNCE: WinPcap 4.0 beta2 has been
> released
>To: "Alto Speckhardt" <Alto at treadstone79.de>,
> <winpcap-users at winpcap.org>
>Message-ID: <035b01c6f6bc$2b74d780$0300a8c0 at NELSON2>
>Content-Type: text/plain; format=flowed; charset="iso-8859-1";
> reply-type=original
>
>By crashes you mean blue screen or application crashes?
>By freeze you mean the complete OS freezing (i.e. you need to reboot).
>Right?
>
>Is Windump crashing/freezing in the same way?
>
>Have a nice day
>GV
>
>
>----- Original Message -----
>From: "Alto Speckhardt" <1603 at gmx.de>
>To: "Gianluca Varenni" <winpcap-users at winpcap.org>
>Sent: Saturday, October 21, 2006 5:34 PM
>Subject: Re: [Winpcap-users] ANNOUNCE: WinPcap 4.0 beta2 has been released
>Hi,
>
>
>GV> WinPcap 4.0 beta2 is available as of today in the download section of
>GV> the WinPcap website, http://www.winpcap.org/install/.
>
>Taking the occasion, I performed some new test with Etherall/Wireshark
>to see whether my crash-problems would be gone with this version of
>WinPCap.
>
>In short: They are not. But they've changed.
>
>I installed WinPCap v4/b2 over v3.1/b4 (no reboot) and tried the
>already installed Ethereal v0.10.14. As usual, the first capture
>start-stop worked. On the second, however, the program failed to show
>any packets, and then wasn't able to stop at all (Stop-button still
>enabled, Start-button hidden). But it didn't freeze as before.
>
>So I thought that maybe the error that I'm seeing would be caught in
>the new version and would no longer lead to the crashs. So I updated
>Ethereall to Wireshark v0.99.3. On starting this one no interfaces
>were detected. Which was not all that surprising since I still had not
>rebooted after updating WinPCap.
>
>After rebooting I startet Wireshark again: First capture start-stop,
>ok. Second start - Freeze.
>
>I then installed WinPCap v3.1/beta 4 again and again started
>Wireshark. Surprise: now it worked.
>
>
>
>I therefore dare say that the problem is not with Ethereal/Wireshark
>but indeed with WinPCap itself. I sure could use some help in
>troubleshooting.
>
>
>
>--
>MfG,
> Alto mailto:Alto at treadstone79.de
>
>
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> >
>
>
>
>------------------------------
>
>Message: 3
>Date: Mon, 23 Oct 2006 09:00:17 -0700
>From: "Gianluca Varenni" <gianluca.varenni at cacetech.com>
>Subject: Re: [Winpcap-users] Multi-threaded application with mutiple
> pcapinstances
>To: <winpcap-users at winpcap.org>
>Message-ID: <036401c6f6bc$58ff78e0$0300a8c0 at NELSON2>
>Content-Type: text/plain; format=flowed; charset="Windows-1252";
> reply-type=response
>
>Tal,
>
>can you please try using WinPcap 4.0 beta2 and tell me if the problem
>persists?
>
>Have a nice day
>GV
>
>
>
>----- Original Message -----
>From: "Tal Cohen" <talc10 at hotmail.com>
>To: <winpcap-users at winpcap.org>
>Sent: Sunday, October 22, 2006 5:06 AM
>Subject: [Winpcap-users] Multi-threaded application with mutiple
>pcapinstances
>
>
> >
> >
> > Hi,
> >
> > (it seems that my previous question was discarded ... HTML...)
> >
> > I'm new with pcap (C++, windows server 2003, pcap ver 3.1) and I would
> > like to get some tips about a real-time appication that I have written:
> > 1. The application create 2 threads. Each thread using its' own pcap
> > instance, where each thread reads a packet, manipuilates it and then
>sends
> > it (using the pcap instance. Read, manipulte and send are implemented on
> > each pcap handler).
> > 2. Each thread is handling different traffic (different pcap filters).
> > 3. The 2 pcap instances share the same NIC.
> > 4. I get a little pcap send packets errors.
> >
> > Do I have to use critical sections / synchronization objects with the
> > above? As I wrote, I use 2 differnet pcap instances but they share the
> > same physical NIC.
> > What can be the reason for the pcap send packet errors? I get only a
> > generic error ("send error: PacketSendPacket failed").
> >
> > Thanks for the help,
> > Tal
> >
> > _________________________________________________________________
> > Stay in touch with old friends and meet new ones with Windows Live
>Spaces
> >
>http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us
> >
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
>
>------------------------------
>
>Message: 4
>Date: Mon, 23 Oct 2006 09:00:45 -0700
>From: "Gianluca Varenni" <gianluca.varenni at cacetech.com>
>Subject: Re: [Winpcap-users] It took 27 seconds to call
> pcap_open_live. Isit ok?
>To: <winpcap-users at winpcap.org>
>Message-ID: <037501c6f6bc$699cdc10$0300a8c0 at NELSON2>
>Content-Type: text/plain; format=flowed; charset="iso-8859-1";
> reply-type=original
>
>Did the solution worked for you?
>
>GV
>
>----- Original Message -----
>From: "Bryan Kadzban" <bryan at kadzban.is-a-geek.net>
>To: <winpcap-users at winpcap.org>
>Sent: Monday, October 23, 2006 4:04 AM
>Subject: Re: [Winpcap-users] It took 27 seconds to call pcap_open_live.
>Isit
>ok?
>
>
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> >
>
>
>
>------------------------------
>
>_______________________________________________
>Winpcap-users mailing list
>Winpcap-users at winpcap.org
>https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
>End of Winpcap-users Digest, Vol 19, Issue 20
>*********************************************
_________________________________________________________________
All-in-one security and maintenance for your PC. Get a free 90-day trial!
http://clk.atdmt.com/MSN/go/msnnkwlo0050000002msn/direct/01/?href=http://www.windowsonecare.com/?sc_cid=msn_hotmail
More information about the Winpcap-users
mailing list