[Winpcap-users] Opening a port multiple times and filters

Paul Rocca Paul.Rocca at audiosoft.co.uk
Tue Jan 8 13:07:35 GMT 2008

I am wrining an app to capture various multicast streams to seperate files.
In order to make my program easier to write I have 1 thread per stream, and
open the NIC card multiple times and pull out the packets and filter them
in my code using src/dst ip addresses. This appears to work great, but
a bit CPU intensive. 
I thought it might be easier then to use the winpcap filter function, so I wrote
a bit of code to do this and that initially appeared to work great, BUT
on further investigation, it would appear that winpcap only uses the last
filter that was set with pcap_setfilter. i.e.
if I have three threads and in in each one I open an instances of my port and
in each thread set a filter on each one (eg thread 1 = 'dst ip', 
thread 2 = 'dst ip', thread 3 = 'dst ip'), then start calling
pcap_next_ex() in each thread, all three threads will only receive packets
matching 'dst ip'
Is this "as designed"?, any ideas for a workaround, or is it back to filtering
in my software?

This e-mail has been scanned for all viruses by Star Internet. The
service is powered by MessageLabs.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20080108/962e2057/attachment.htm

More information about the Winpcap-users mailing list