On Apr 19, 2004, at 1:46 PM, Jinhai Yang wrote:
I'm looking at set up proper filter rules for an adapter with two IP addresses. My question is: Does winpcap work with adapter with multiple IP addresses?
(This is actually a generic libpcap issue, so my answer applies on UN*X as well as Windows.)
I looked at the code, seems to me pcap_lookupnet() and pcap_compile() both assume one IP address per adapter.
"pcap_lookupnet()" does assume one IP address per adapter; "pcap_findalldevs()" doesn't.
"pcap_compile()" does handle only one IP address per adapter - but the *ONLY* place where it uses the netmask is in tests for IP broadcast addresses.
In the windump code(tcpdump.c), pcap_lookupnet() only returns the first IP address of the adapter. Pcap_compile() then takes the netmask returned by pcap_lookupnet(). What happens if the adapter has two IP addresses and they have different netmasks?
What happens is that filter expressions that include "ip broadcast" check only for broadcast addresses for the first netmask. (Note, by the way, that "ip broadcast" doesn't check for 255.255.255.255.) *Everything else* works fine.
Am I missing something? What should I do to make it work for multiple IPs per adapter case?
Either
1) don't use "ip broadcast"
or
2) add a new API to libpcap to allow multiple netmasks to be supplied and use that.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
