RE: [WinPcap-users] Generic and specific NDISWAN interfaces in WinPcap 3.1 beta 4?
-Original Message-
From: Loris Degioanni [mailto:[EMAIL PROTECTED]
Sent: martedì 15 febbraio 2005 7.38
To: winpcap-users@winpcap.polito.it
Subject: Re: [WinPcap-users] Generic and specific NDISWAN interfaces in
WinPcap 3.1 beta 4?
Guy Harris wrote:
Somebody trying to capture on a serial port in Ethereal sent a long
note about that to the Ethereal list:
http://www.ethereal.com/lists/ethereal-users/200502/msg00140.html
It says:
5) Because Windows PPP support is new, there is nothing about it in
the Help portion of Ethereal (Live Preserver Icon) or in the online
hypertext Help or online PDF Help file. I have attached some screen
captures which show that the PPP adapter doesn't show up as available
until the computer has established a dial-up connection with the
internet. At first all that showed up was Generic NdisWan adapter:
\Device\NPF_GenericNdisWanAdapter. However I was able to capture my
dial-up conversations with my internet ISP using this Generic Ndis Wan
adapter. After I established the dial-up connection an additional
adapter showed up WAN (PPP/SLIP) Interface:
\Device\NPF_{F37D0895-3FB0-4946-89D1-42FE988DBA90}. I
reloaded a fresh
image of Win 2K and verified that the key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\
Interfaces\{F37D0895-3FB0-4946-89D1-42FE988DBA90}
was present prior to loading WinPcap and Ethereal. It was. This raises
the question of why WinPcap can't find it until going online and
establishing a dial-up conncection and what the differences
are, if any,
between the two adapters.
and shows a before going online image:
http://www.ethereal.com/lists/ethereal-users/200502/gif6.gif
with only Generic NdisWan adapter:
\Device\NPF_GenericNdisWanAdapter and an after going online image:
http://www.ethereal.com/lists/ethereal-users/200502/gif3.gif
which shows that interface *and* a WAN (PPP/SLIP) Interface:
\Device\NPF_{GUID inserted here} interface.
I assume that the latter gets instantiated when an actual PPP
connection is set up. I assume that he expected an interface that
explicitly mentioned PPP to show up, but was presumably pleasantly
surprised to find that he can capture on the generic interface.
Is there any reason not to tell people to capture on the generic
interface and ignore any specific interfaces that show up after you
connect?
The reason why we added the fake GenericNdisWanAdapter interface is that
some users complained about not being able to capture before the
instantiation of a PPP connection. In fact, the connection is present in
the registry *before* calling the phone number, but the IP Helper API
shows it (and WinPcap is allowed to open it) only *after* doing that.
Actually, I think that a better name (like GenericPPPAdapter) could be
useful, since many people don't know understand NdisWanAdapter mean.
If the other developers agree on this, I can change the code with the
new name.
GenericDialUpAdapter sounds better to me.
fulvio
= This is the
WinPcap users list. It is archived at
http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use
mailto: [EMAIL PROTECTED]
=
Re: [WinPcap-users] Generic and specific NDISWAN interfaces in WinPcap 3.1 beta 4?
- Original Message -
From: Loris Degioanni [EMAIL PROTECTED]
To: winpcap-users@winpcap.polito.it
Sent: Tuesday, February 15, 2005 7:37 AM
Subject: Re: [WinPcap-users] Generic and specific NDISWAN interfaces in
WinPcap 3.1 beta 4?
Guy Harris wrote:
Somebody trying to capture on a serial port in Ethereal sent a long
note about that to the Ethereal list:
http://www.ethereal.com/lists/ethereal-users/200502/msg00140.html
It says:
5) Because Windows PPP support is new, there is nothing about it in
the Help portion of Ethereal (Live Preserver Icon) or in the online
hypertext Help or online PDF Help file. I have attached some screen
captures which show that the PPP adapter doesn't show up as available
until the computer has established a dial-up connection with the
internet. At first all that showed up was Generic NdisWan adapter:
\Device\NPF_GenericNdisWanAdapter. However I was able to capture my
dial-up conversations with my internet ISP using this Generic Ndis Wan
adapter. After I established the dial-up connection an additional
adapter showed up WAN (PPP/SLIP) Interface:
\Device\NPF_{F37D0895-3FB0-4946-89D1-42FE988DBA90}. I reloaded a fresh
image of Win 2K and verified that the key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{F37D0895-3FB0-4946-89D1-42FE988DBA90}
was present prior to loading WinPcap and Ethereal. It was. This raises
the question of why WinPcap can't find it until going online and
establishing a dial-up conncection and what the differences are, if
any,
between the two adapters.
and shows a before going online image:
http://www.ethereal.com/lists/ethereal-users/200502/gif6.gif
with only Generic NdisWan adapter:
\Device\NPF_GenericNdisWanAdapter and an after going online image:
http://www.ethereal.com/lists/ethereal-users/200502/gif3.gif
which shows that interface *and* a WAN (PPP/SLIP) Interface:
\Device\NPF_{GUID inserted here} interface.
I assume that the latter gets instantiated when an actual PPP
connection is set up. I assume that he expected an interface that
explicitly mentioned PPP to show up, but was presumably pleasantly
surprised to find that he can capture on the generic interface.
Is there any reason not to tell people to capture on the generic
interface and ignore any specific interfaces that show up after you
connect?
The reason why we added the fake GenericNdisWanAdapter interface is that
some users complained about not being able to capture before the
instantiation of a PPP connection. In fact, the connection is present in
the registry *before* calling the phone number, but the IP Helper API
shows it (and WinPcap is allowed to open it) only *after* doing that.
Moreover, the Generic Ndiswan adapter is available before a connection is
established, but it does not have any IP address associated. The IP
addresses are associated to the specific interfaces that are available after
the connection is established.
Actually, I think that a better name (like GenericPPPAdapter) could be
useful, since many people don't know understand NdisWanAdapter mean.
If the other developers agree on this, I can change the code with the new
name.
This is a good idea. I only want to check if the WanAdapter supports PPP
connections only, or other ones, as well (like VPNs and SLIP, if there is
still someone using SLIP...).
Have a nice day
GV
Loris
==
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use mailto:
[EMAIL PROTECTED]
==
==
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use
mailto: [EMAIL PROTECTED]
==
Re: [WinPcap-users] Generic and specific NDISWAN interfaces in WinPcap 3.1 beta 4?
Fulvio Risso wrote: GenericDialUpAdapter sounds better to me. ...although if you think of dial-up as opposed to, for example, broadband, is the NDISWAN stuff used for PPPoE or PPPoA for ADSL? == This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ To unsubscribe use mailto: [EMAIL PROTECTED] ==
