[Winpcap-users] Missing Packets when Application captures from Network

JB twaigel at gmx.de
Tue Feb 21 05:13:35 PST 2012


Hi Guys,

i have a question which belongs to a scenario where an WinPCap-dependent 
Application is deployed and started from a network-ressource.
The application initiates a SMB-Connection via Windows-API und observes 
incoming Packets via WinPCap.
The Application should then recognize wether a SMB, or a SMB2 Connection 
is established, and act accordingly.
It should work relatively straight forward, since it should open an 
adapter, start a thread which polls the interface for received packets, 
puts them on a custom objectmodel, and checks some Bytes in the Protocoll.

Locally it works fine, but if i start it from a remote-share i am 
missing packets.
I think my Application works in a correct manner, but i am missing these 
packets, when i check and controll all the messages received on a 
certain interface.
The strange behaviour  I observed is, that the pcap-interface only gets 
Packets from and to the same host, where the Application is located.

I already tried some issues regarding Performance of my tool, Buffering, 
Snaplens and Adapter-Sleeptimes, without success.

Has anybody else a similar scenario, where such behaviour can be 
observed, or am I the only one facing such problems?
(In that case, the application might work not 100% correct).
Is my basic scenario right, or did i forget some important things?
Could this be a bug?

Could provide Code-Snipptes if needed!

Thanks in advance for eventual help!

P.S.: Actually i don't use any filters!

Regards
Odem


More information about the Winpcap-users mailing list