[Winpcap-users] Captured packets buffered and not returned to theapplication immediately

Gianluca Varenni gianluca.varenni at cacetech.com
Thu Dec 11 00:13:17 GMT 2008

If you set the timeout to 0 (infinite timeout), mintocopy is the factor affecting the reception.

pcap_next_ex (or any other WinPcap receive function) will return
- after the timeout (unless you used 0)
- when at least mintocopy bytes are stored in the kernel buffer

(whatever happens first).

It's not a bug in WinPcap, this is by design. Why are you using an infinite timeout?

Have a nice day
  ----- Original Message ----- 
  From: Oliver Zheng 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, December 10, 2008 3:28 PM
  Subject: [Winpcap-users] Captured packets buffered and not returned to theapplication immediately


  I'm using WinPcap in an application to capture packets, but it seems that calls made to pcap_next() do not return immediately when a packet is received. The timeout is set to 0 (blocking indefinitely). The packets seem to be buffered in some location, so that in order to see a packet that just arrived, I have to capture a lot more packets for that packet to be flushed to my application. I am comparing my results to that of Wireshark, which seems to display packets immediately as they are received.

  Does anyone know what could be causing it and how it can be fixed? I'm on Windows XP SP3, using WinPcap 4.0.2, pre-built.

  Thanks in advance,


  Winpcap-users mailing list
  Winpcap-users at winpcap.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20081211/04f34839/attachment.htm

More information about the Winpcap-users mailing list