Ty so much for answer. Which method do you suggest me to use pcap_loop or pcap_next_ex? Why use pcap_open for statistics?
On Tue, Jul 19, 2011 at 4:22 PM, Helmut Vaupotitsch <[email protected]>wrote: > ** > Hi, > > This is possible if you use separate threads. > Be sure that you leave your capture callback routine as soon as possible, > otherwise you will loose packets. (consider to use queues) > Use Pcap_stats_ex (with a capture driver handle) to detect packet drops. > > On a given *single* adapter, i use pcap_open_live twice(for capturing) and > pcap_open twice(with to_ms=1000 and pcap_setmode for statistics mode). The > NPF filters can be set and altered at any time without influencing the > others. > > Regards > Helmut > > Emre Erişgen schrieb: > > I want to explain my question a little bit more. > > > > Is it doable to listen a device with 2 different filters and capture > packets? For example i start listening a device with a filter and dumping > the packets to a pcap file, after 15min can i start another listen on the > same device with different filter and dump the packets to another pcap file > without stopping the old one? > > > > Does pcap_open or pcap_next_ex block the incoming packets? What i mean if a > packet arrives while listening from two different threads one of them will > get the packet and control it for filter can the other thread access the > packet? > > > > ------------------------------ > > _______________________________________________ > Winpcap-users mailing > [email protected]https://www.winpcap.org/mailman/listinfo/winpcap-users > > > _______________________________________________ > Winpcap-users mailing list > [email protected] > https://www.winpcap.org/mailman/listinfo/winpcap-users > >
_______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
