[Winpcap-users] pcap_findalldevs_ex in thread behaviour ?

Gianluca Varenni gianluca.varenni at cacetech.com
Sun Dec 21 19:35:58 GMT 2008

It's definitely true, there is no such FAQ that explains this weird 

One of the reasons behind that is that I never took the time to write it 
down, and it would take a bit to write something that is complete and 
explains all the possible scenarios. Just to give you an idea, the behavior 
of dialup connections changes between the different versions of Windows, in 
particular Win2000 (which we still support) is different from XP/Vista...

Have a nice day

----- Original Message ----- 
From: <psachet.ext at orange-ftgroup.com>
To: <winpcap-users at winpcap.org>
Sent: Tuesday, December 16, 2008 1:33 AM
Subject: RE: [Winpcap-users] pcap_findalldevs_ex in thread behaviour ?

> Thx a lot for the replies, the problem is solved now.
> Btw there is something about the dialup connection in the FAQ but it is 
> just talking about process-permissions and not at all about threading.
> Regards,
> Patrick Sachet
> -----Message d'origine-----
> De : winpcap-users-bounces at winpcap.org 
> [mailto:winpcap-users-bounces at winpcap.org] De la part de Bryan Kadzban
> Envoyé : mardi 16 décembre 2008 04:46
> À : winpcap-users at winpcap.org
> Objet : Re: [Winpcap-users] pcap_findalldevs_ex in thread behaviour ?
> Gianluca Varenni wrote:
>> It's not just enumerating them... it's capturing on them.
> Oh, right, duh.  Any interaction needs to be from the single thread.
>> I've been thinking a lot about this issue, and the only safe patch to
>> the problem is actually spawning a separate process capturing from
>> NetMon and piping the packets back.
> Does NetMon provide a proxy/stub pair (or does it work with the standard 
> COM marshaller) that would work instead?  That's the standard fix when you 
> need to interact with an STA interface from an MTA thread, or any thread 
> that isn't the one that created that interface: marshal the calls over to 
> the correct thread, and marshal the return stuff back.  Most COM wrappers 
> seem to do this automatically, as well, so maybe it isn't possible here.
> Also, if the netmon coclass is STA-only, then this will only work if the 
> netmon interface pointer is already present and has been moved over to the 
> target thread (CoMarshalInterThreadInterfaceInStream followed by a 
> CoGetInterfaceAndReleaseStream in the other thread).  It will also only 
> work if the STA thread is pumping messages...
> Maybe a separate process is safer.  ;-)
> *********************************
> This message and any attachments (the "message") are confidential and 
> intended solely for the addressees.
> Any unauthorised use or dissemination is prohibited.
> Messages are susceptible to alteration.
> France Telecom Group shall not be liable for the message if altered, 
> changed or falsified.
> If you are not the intended addressee of this message, please cancel it 
> immediately and inform the sender.
> ********************************
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users 

More information about the Winpcap-users mailing list