Re: [WinPcap-users] Odd behavior (sort of a bug)
- Original Message - From: Rob Henningsgard [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, May 12, 2004 9:51 PM Subject: [WinPcap-users] Odd behavior (sort of a bug) Hello all, Has anybody else run WinPcap 3.1 beta 2 in Win2000 with no TCP-IP installed on the machine? I've been running fine for weeks with TCP-IP disabled, but then I realized that with all of the stupid TCP and UDP listening ports Windows opens up (can you say, virus invitations?), I really didn't want TCP-IP installed at all. So I removed TCP-IP, and re-ran my program. Surprise! WinPcap (OK, actually Packet32) throws up errors saying, Can not find TCP/IP bindings. In order to run the packet capture driver you must install TCP-IP. Guess what? It is not true! WinPcap runs perfectly with no TCP-IP driver installed, both with my own application and with Ethereal (although Ethereal _does_ throw an access violation when you quit the program). Hi. You are right, there's a bug in packet.dll under NTx that causes winpcap 3.1beta2 to show that message if TCP/IP is removed from the machine. I've corrected that bug in our source tree, and it be available in winpcap beta3, that will be released in a week. So has anybody else encountered this? I just joined MSDN and have not received, installed, or tested my DDK yet, so I am not comfortable rebuilding Packet32.DLL with the error message and false return to PacketGetAdapterNames() commented out (about line 1671 of Packet32.C). Could somebody on the list perhaps do a quick build of that for me? I'd be much obliged. Why the DDK? You don't need the DDK to compile packet.dll, you need VC6 plus the platform sdk. Have a nice day GV Thanks to all, Rob--- - LapTwo Technology Corporation Phone: 763-633-9434 16820 Highway 10, Suite 130 Fax: 253-276-2755 Elk River, Minnesota 55330 http://www.laptwo.com - == This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] == == This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==
Re: [WinPcap-users] Odd behavior (sort of a bug)
- Original Message - From: Rob Henningsgard [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, May 13, 2004 2:52 PM Subject: Re: [WinPcap-users] Odd behavior (sort of a bug) Gianluca, It is not true! WinPcap runs perfectly with no TCP-IP driver You are right, there's a bug in packet.dll under NTx that causes winpcap 3.1beta2 to show that message if TCP/IP is removed Oh good! I'm really glad to hear that it's a bug, and not that I was doing something dumb (which happens often enough). I've corrected that bug in our source tree, and it be available in winpcap beta3, that will be released in a week. That is just super! You and your colleagues are the greatest. have not received, installed, or tested my DDK yet Why the DDK? You don't need the DDK... you need VC6 plus the platform sdk. Oh, got it. Actually, I don't have VC6 either. I only recently converted from seventeen years of using only Borland tools, and I bought Visual Studio .NET Pro. So the only VC I've got is 7.0. What's the problem, then? You can import the VC6 project into VC 7.0, and compile with that compiler. I develop and build with VC7.1 (but I build the official release with VC6.0 because of compatibility reasons). Have a nice day GV I got the MSDN DDK because I will eventually need to write an NDIS miniport driver, to sit in front of Windows TCP-IP and filter out packets I do not want Windows to ever see. Have a nice day, GV Thanks again for everything, Gianluca. Rob--- - LapTwo Technology Corporation Phone: 763-633-9434 16820 Highway 10, Suite 130 Fax: 253-276-2755 Elk River, Minnesota 55330 http://www.laptwo.com - == This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] == == This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==
RE: [WinPcap-users] Odd behavior (sort of a bug)
-Original Message- From: Rob Henningsgard [mailto:[EMAIL PROTECTED] Sent: giovedi 13 maggio 2004 14.52 To: [EMAIL PROTECTED] Subject: Re: [WinPcap-users] Odd behavior (sort of a bug) Gianluca, It is not true! WinPcap runs perfectly with no TCP-IP driver You are right, there's a bug in packet.dll under NTx that causes winpcap 3.1beta2 to show that message if TCP/IP is removed Oh good! I'm really glad to hear that it's a bug, and not that I was doing something dumb (which happens often enough). I've corrected that bug in our source tree, and it be available in winpcap beta3, that will be released in a week. That is just super! You and your colleagues are the greatest. What about a gift? http://winpcap.polito.it/misc/wlist.htm ;-) Cheers, fulvio == This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==
RE: [WinPcap-users] Odd behavior (sort of a bug)
Rob, Are you sure you have WinPcap 3.1 beta 2? The message you are referring to is produced by line 962 in file AdInfo.c which is in function PacketGetAdapters(). Robert Thornthwaite Input/Output, Inc. Guess what? It is not true! WinPcap runs perfectly with no TCP-IP driver installed, both with my own application and with Ethereal (although Ethereal _does_ throw an access violation when you quit the program). So has anybody else encountered this? I just joined MSDN and have not received, installed, or tested my DDK yet, so I am not comfortable rebuilding Packet32.DLL with the error message and false return to PacketGetAdapterNames() commented out (about line 1671 of Packet32.C). Could somebody on the list perhaps do a quick build of that for me? I'd be much obliged. = This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] =
RE: [WinPcap-users] Odd behavior (sort of a bug)
Hi Robert, Are you sure you have WinPcap 3.1 beta 2? Yes. The message you are referring to is produced by line 962 in file AdInfo.c=20 which is in function PacketGetAdapters(). =20 No, it was emanating from Packet32.DLL, at base address $2078. I am saying was in definite terms because I just hand-patched a copy of PACKET32.DLL to replace the setup and call to MessageBox() with twenty-two $90's (NOPs), and my application runs fine now with no error messages. For anyone else reading this list, I should hasten to point out that I am using only a _very_ small sub-set of the WinPcap functions, mainly pcap_next_ex() and pcap_sendpacket(). So I know the basic functioning of Packet32 is intact despite the lack of an installed TCP-IP driver, and ignoring this error. I note also that other WinPcap functions apparently rely on the TCP-IP driver, because Ethereal will not run properly with the patched DLL. So no way could I openly recommend this hack to anyone else... it's just a temporary way for me to mask the driver's intended behavior, until I can take the time to research the matter further. Hmm I wonder how difficult it would be to just temporarily hook the kernel's MessageBox() code, and discard that particular call from Packet32? I do hate to have a patched DLL on my machine for any length of time. Any suggestions, anyone? Rob--- - LapTwo Technology Corporation Phone: 763-633-9434 16820 Highway 10, Suite 130 Fax: 253-276-2755 Elk River, Minnesota 55330 http://www.laptwo.com - == This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==
RE: [WinPcap-users] Odd behavior (sort of a bug)
Sorry to reply to my own post, but that last one should have read PACKET.DLL, not PACKET32.DLL of course. Rob--- - LapTwo Technology Corporation Phone: 763-633-9434 16820 Highway 10, Suite 130 Fax: 253-276-2755 Elk River, Minnesota 55330 http://www.laptwo.com - == This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==
