Hi,
This is possible if you use separate threads.
Be sure that you leave your capture callback routine as soon as
possible, otherwise you will loose packets. (consider to use queues)
Use Pcap_stats_ex (with a capture driver handle) to detect packet drops.
On a given *single* adapter, i use pcap_open_live twice(for capturing)
and pcap_open twice(with to_ms=1000 and pcap_setmode for statistics
mode). The NPF filters can be set and altered at any time without
influencing the others.
Regards
Helmut
Emre Eris,gen schrieb:
I want to explain my question a little bit more.
Is it doable to listen a device with 2 different filters and capture
packets? For example i start listening a device with a filter and
dumping the packets to a pcap file, after 15min can i start another
listen on the same device with different filter and dump the packets
to another pcap file without stopping the old one?
Does pcap_open or pcap_next_ex block the incoming packets? What i mean
if a packet arrives while listening from two different threads one of
them will get the packet and control it for filter can the other
thread access the packet?
------------------------------------------------------------------------
_______________________________________________
Winpcap-users mailing list
[email protected]
https://www.winpcap.org/mailman/listinfo/winpcap-users
_______________________________________________
Winpcap-users mailing list
[email protected]
https://www.winpcap.org/mailman/listinfo/winpcap-users
