Hi.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: giovedi 11 novembre 2004 21.18
To: [EMAIL PROTECTED]
Subject: [WinPcap-users] setfilter
Hello...
Can I set a new filter on an ongoing capture without missing a packet?
Discription:
I set a 'port
1) FCS (CRC) has 4 bytes, it is included in the Ethernet protocol, which
means it is actually going over the wire, but the applications won't see it.
Winpcap included. This explains the 4 bytes diff.
2) The 4764 is padding, again, over the wire, the minimum frame size for
Ethernet is 60+4 Bytes,
Fulvio Risso wrote:
This beaviour is needed, otherwise you may receive packets satifying the old
filter after setting the new one.
Absolutely. The same is done in the BPF code in BSD. It's not done in
the Linux socket filter code - but people complained about that, because
they set a filter
