----- Original Message ----- > PS> Hi, > > PS> Does someone know what is the maximum length of the filter string I can pass to pcap_compile()? More importantly, does winpcap have limited sized datastructures to represent the filter in its > PS> internals? > > PS> Thanks > PS> Pawan Singh > PS> [EMAIL PROTECTED] > > Hi. > Maybe I've misunderstood the question, but of course wpcap has some > structures that represent filter, because filter string is a > high-level matter, on a lower level (packet.dll) there is no readable > string, you only have a list of instructions, that can be loaded > on the kernel level. > > pcap_compile() in its internals transforms filter string > into a set of instructions. > > So, it's on high level (wpcap.dll). > > int pcap_compile ( > pcap_t * p, > struct bpf_program * fp, > char * str, > int optimize, > bpf_u_int32 netmask > ) > > and low-level (packet.dll): > > BOOLEAN PacketSetBpf ( > LPADAPTER AdapterObject, > struct bpf_program * fp > ) > > Further details may be found in WinPcap Documentation (don't forget to > check "Packet.dll exported functions and variables" of winpcap > developer's manual). > > Best regards, > Andrew Fedyashov
>From the packet.dll point of view (and for the underlying driver, npf.sys) there is no limit on the number of BPF instructions for a filter. >From the point of view of wpcap.dll (pcap_compile()), I'm not sure if there is a limit on the input string and/or the generated BPF instructions. However, the filter compiler is a port of the one shipped with libpcap, so I think you should post a question in the tcpdump-workers mailing list (details on this ML at www.tcpdump.org). Have a nice day GV > > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/[EMAIL PROTECTED]/ > > To unsubscribe use > mailto: [EMAIL PROTECTED] > ================================================================== ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
