Hi, > "Alan S. Jones" <[EMAIL PROTECTED]> said: > > > I have been watching some of the WinPcap 3.1 beta development along with > > NMap development. At one point I ran into some problems with NMap after I > > upgraded to WinPcap 3.1 beta. Not figuring anything else out till I ran > > across some comments that made me downgrade to WinPcap 3.0 and things > > seemed to work fine. > > > > My impression from reading the WinPcap list was that programs should not > > need to make any changes to work between WinPcap 3.0 and 3.1. > > That was surely the intention of the WinPcap developers, but practice and > "implicit" rules like ASCII naming are used only on Win-9x and Unicode on > Win-NT was broken in the 3.1 update.
There is no implicit rule. Since we wrote it, the WinPcap documentation, under the packet.dll paragraph, contains the following statement: -------------------------------- Important note, read carefully! If you are writing a capture application and you do not have particular/low level requirements, you are *recommended* to use the functions of wpcap, that are compatible with the ones of the Unix packet capture library (libpcap), instead of the API described in this chapter. wpcap.dll relies on packet.dll, but provides a more powerful, immediate and easy to use programming environment. With wpcap.dll, operations like capturing a packet, creating a capture filter or saving a dump on a file are safely implemented and intuitive to use. Moreover, the programs written to use libpcap are easily compiled on Unix thanks to the compatibility between Win32 and Unix versions of this library. As a consequence, since the *normal* and *suggested* way for an application to use WinPcap is through wpcap.dll, *we cannot guarantee that the packet.dll API will not be changed in the future releases*. -------------------------------- Regarding applications written to use wpcap.dll (i.e. libpcap), they will work without problems with WinPcap 3.1. > Many programs (including nmap) > makes this assumption. Not really surprising since many of the WinPcap > examples does the same thing "Many of the WinPcap examples" means the ones (two) that use packet.dll. Some time ago, we moved them in a subfolder to discourage their use. At this point, it is probably better to definitely remove them. > So instead of breaking this rule, our Italian friends should IMHO have created > a new function that returns ASCII on Win-NT+ and a backward compatible function > that returns Unicode on Win-NT+. Kind of messy, but ... No way. Packet.dll is a support library, written mainly for internal purpose. Your Italian friend works with it almost every day, so he doesn't want a crappy API, and he will change it to keep it as clean as possible. I've clearly written this. If you want to use the library, do it: the API is free as well as its source code. But don't complain if we change it. Loris > > This is the URL of the start of a thread in the NMap group about a fix to > > get 3.1 to work: > > http://seclists.org/lists/nmap-dev/2004/Jan-Mar/0077.html > > Sounds familiar since I wrote that :) But isn't there an updated binary of nmap > you can use? Or compile it yourself? > > BTW. There are other problems with pcap_open_live() in 3.1; If you > pass a device on a machine with >= 2 devices (in my case the RealTek > eth adapter and the IPv6 pseudo tunnelling device), the PacketOpenAdapter() > will fail since (OTOH) the list of *all* devices hasn't been found at that point > (since PacketGetAdapterNames() and PacketPopulateAdaptersInfoList() > hasn't been called). > > An easy fix is to do "(void) pcap_lookupdev(errbuf)" (or pcap_findalldevs*()) > before pcap_open_live() on the device you want to use. > > --gv > > GNU GPL: Free as in herpes. > > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/[EMAIL PROTECTED]/ > > To unsubscribe use > mailto: [EMAIL PROTECTED] > ================================================================== ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
