Are you writing to a remote share file when running from there?
Or do you mean remote desktop? I can't imagine why it would make any difference to pcap as to what file system it came from. I also can't imagine why you would see packets from the application LOCATION and not the host RUNNING the app. I can imagine remote desktop causing problems. You should be able to make a small demo program that the rest of us can test? You also realize that if you are on a switch instead of a hub you won't see any other network traffic? Unless you have a monitoring port you can plug in to? Michael D. Black Senior Scientist Advanced Analytics Directorate Advanced GEOINT Solutions Operating Unit Northrop Grumman Information Systems ________________________________ From: [email protected] [[email protected]] on behalf of JB [[email protected]] Sent: Tuesday, February 21, 2012 4:55 AM To: [email protected] Subject: EXT :[Winpcap-users] Missing Packets when Application captures from Network Hi Guys, i have a question which belongs to a scenario where an WinPCap-dependent Application is deployed and started from a network-ressource. The application initiates a SMB-Connection via Windows-API und observes incoming Packets via WinPCap. The Application should then recognize wether a SMB, or a SMB2 Connection is established, and act accordingly. It should work relatively straight forward, since it should open an adapter, start a thread which polls the interface for received packets, puts them on a custom objectmodel, and checks some Bytes in the Protocoll. Locally it works fine, but if i start it from a remote-share i am missing packets. I think my Application works in a correct manner, but i am missing these packets, when i check and controll all the messages received on a certain interface. The strange behaviour I observed is, that the pcap-interface only gets Packets from and to the same host, where the Application is located. I already tried some issues regarding Performance of my tool, Buffering, Snaplens and Adapter-Sleeptimes, without success. Has anybody else a similar scenario, where such behaviour can be observed, or am I the only one facing such problems? (In that case, the application might work not 100% correct). Is my basic scenario right, or did i forget some important things? Could this be a bug? Could provide Code-Snipptes if needed! Thanks in advance for eventual help! Regards Odem _______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
_______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
