On Sep 28, 2016, at 9:23 PM, Daniel Smith <[email protected]> wrote:
> It looks like I just misinterpreted this piece of the documentation: > > "Defines if the local adapter will capture its own generated traffic. > This flag tells the underlying capture driver to drop the packets that were > sent by itself. This is usefult when building applications like bridges, that > should ignore the traffic they just sent." > > But PCAP_OPENFLAG_NOCAPTURE_LOCAL doesn't do *quite* that, instead of being > based on if the traffic was sent by the driver/local adapter it actually > seems to be dependent on if it was sent by the exact pcap_open function that > the device pointer holds. "Itself" here means "the underlying capture driver"; if a packet was sent by the regular networking stack, that's *not* one of the packets that gets dropped - only packets sent by the capture driver, i.e. sent by a pcap call, count. It may also be that it only detects packets sent by the same *instance* of the driver, so that it only filters out packets sent using the same pcap_t. _______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
