You say: > If the adapter disconnects (like Wi-Fi), libpcap API should only report > time-out (you don't get any new packets).
Not all libpcap/WinPcap/npcap applications are sniffers which permanently hang on a pcap_t waiting for packet arrival. Some periodically poll for packets and count on the timeout behavior which is currently available. A linkstate change is a significant event which should be discernable using the pcap API if an error is returned (-1). You also say: > Npcap actually doesn't report errors any better than WinPcap. There's even a > chance that Npcap behaves different on reporting errors with WinPcap. Because > Npcap uses NDIS6 and WinPcap uses NDIS5. Well, it may not, but WinPcap is frozen and npcap is actively being developed. We’re discussing how to address the deficiency in the current behavior in the most appropriate way. Given that NDIS6 is the modern API to access this stuff and it is closer to the real hardware it would seem that this information would be more available and certainly could be added. From: [email protected] [mailto:[email protected]] On Behalf Of ?????V5 Sent: Thursday, February 4, 2016 8:44 PM To: [email protected] Subject: Re: [Winpcap-users] Windows 10 support for WinPcap On Fri, Feb 5, 2016 at 3:56 AM, Mark Pizzolato - Winpcap-Users <[email protected]<mailto:[email protected]>> wrote: The inverted call model might be useful in an abstract way to get notified of a media state change, however, the question then comes back to how to convey that detail to the application which is using the libpcap APIs. Since the only APIs that an application which already has a pcap session opened is using are: pcap_next_ex, pcap_dispatch, pcap_loop and possibly pcap_sendpacket pcap_next_ex, pcap_dispatch and pcap_loop are defined to return -1 on an error. Is media state change an error? Is media offline an error? I prefer to use the phrases in ncpa.cpl. If the adapter disconnects (like Wi-Fi), libpcap API should only report time-out (you don't get any new packets). If the adapter is disabled, libpcap API may report error (or time-out)? I didn't try this. One thing for sure is that you can't get new packets too. This thing should not happen when using Npcap/WinPcap. Because when listing adapters with Npcap/WinPcap, disabled adapters never show up on the list. So Npcap/WinPcap assumes that the adapters it uses is always kept as enabled. pcap_sendpacket is defined to return -1 if a packet wasn’t successfully sent. It would seem that returning -1 when the media is offline makes sense This makes sense to me. I don’t know for sure how WinPcap behaves under these conditions, but it seems that it npcap should reliably report errors under the media offline state. Is there a reason it can’t? Npcap actually doesn't report errors any better than WinPcap. There's even a chance that Npcap behaves different on reporting errors with WinPcap. Because Npcap uses NDIS6 and WinPcap uses NDIS5. From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of Jiyang Hu Sent: Thursday, February 4, 2016 11:18 AM To: [email protected]<mailto:[email protected]> Subject: Re: [Winpcap-users] Windows 10 support for WinPcap @Sven: you need something called - Inverted Call Model The Inverted Call Model in KMDF - OSR<https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/> [cid:[email protected]]<https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/> The Inverted Call Model in KMDF - OSR<https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/> One of the most common questions we see from students, clients, and new Windows driver Read more View on www.osr.com<https://www.osr.com/nt-insider/2013-issue1/inverted-call-model-kmdf/> Preview by Yahoo On Thursday, February 4, 2016 12:49 PM, Sven Kerschbaum <[email protected]<mailto:[email protected]>> wrote: @Yang: It is not possible to get notifications of media state changes by the API which you proposed in your previous post. It provides only notifications about IP table changes. Am 04.02.2016 16:31 schrieb "Sven Kerschbaum" <[email protected]<mailto:[email protected]>>: Hi Yang, thanks for providing me the detailed information about Npcap. I will definitively have a look at it and try it. Cheers, SK
_______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
