The fact is that on several NT4 installations it isn't possible to use
winpcap over an adapter without TCP-IP, simply because there is no binding
information.
WinPcap tries to use the
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318
}, that normally contains adapters information. If this key is empty, the
only binding info that can be retrieved is the TCP-IP one (i.e. from
SYSTEM\CurrentControlSet\Services\Tcpip\Linkage).
In this case, you will only see interfaces with an IP address.Loris > I have a computer with two NICs one used for trusted connections to our > backend and one, an untrusted interface to the internet. I want to take > advantage of the new v2.3 capability to " work on systems without TCP/IP" by > unbinding TCP and WINS from the NIC facing the internet. > > However, as I've read, part of the logic that winpcap uses to dynamically > bind to the NDIS layer takes its lead from the TCP/IP settings. However, > when I unbind TCP/IP from the internet facing NIC, it no longer appears > available to bind to the winpcap driver. Only the NIC with the TCP/IP > binding appears. > > Has anyone succeeded in getting winpcap to sniff from a NIC without an > TCP/IP stack? > > I am using Windows NT 4.0 with service pack 6 and winpcap v3.2. >
