Hi, I got another problem with WinPCap v2.3 on the same machine. After running my application or pktdump.exe, which comes with the WinPCap developer package for several hours, the callback function which called by pcap_loop() got both caplen and len equals zero, but pcap_loop() didn't terminate w/ error. So pktdump.exe eats up almost all the CPU cycles w/o doing anything useful (it just kept calling the callback with zero packet). Any idea about this problem? I am not sure if there's something wrong with promisc mode of the network interface. Is there any tool I can use to check the promisc status of the network interface on WinNT 4.0?
Thanks in advance, Wayne -----Original Message----- From: Loris Degioanni [mailto:[EMAIL PROTECTED]] Sent: Thursday, May 30, 2002 5:56 AM To: Wayne Huang Cc: winpcap Subject: R: [WinPcap-users] caplen and len mismatch This sound very strange, since no users reported problems of this kind until now. Do you confirm that caplen is *always* one byte less than len? Can you provide a small capture that shows the problem? Loris > Hi Loris, > > I didn't set any filtering and also I don't have programs like firewalls or > PGPNet on the machine. I tried several snaplen settings like 65536, 100, > 6553 but seems they have the same problem. And to simplify the situation, I > used the example within the WinpCap developer packet called pktdump, and > this one has the same problem. > The problem only happens on WinNT 4.0 . > > Thanks a lot, > Wayne > > -----Original Message----- > From: Loris Degioanni [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, May 29, 2002 4:14 AM > To: [EMAIL PROTECTED] > Cc: Wayne Huang > Subject: Re: [WinPcap-users] caplen and len mismatch > > > Are you setting a filter? > What snaplen are you setting in pcap_open_live? > Have you programs like firewalls or PGPNet on the machine? > > > > > Hi, > > I developed an tcp traffic analysis application using Winpcap 2.3. It > works > > fine under Win2000, but I got a problem under WinNT w/ SP4 or SP6. > > > > When I check the header of the packet I got, I found there's a mismatch > > between caplen (captured length) and len (packet length), and the caplen > is > > always one byte less than len. > > > > Is there anyone who encountered this problem? > > > > Thanks in advance, > > Wayne > >
