Hi.
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: giovedi 11 novembre 2004 21.18
> To: [EMAIL PROTECTED]
> Subject: [WinPcap-users] setfilter
>
>
> Hello...
>
> Can I set a new filter on an ongoing capture without missing a packet?
>
> Discription:
> I set a 'port 1111' filter expression and listen to the traffic. Now I
> want to extend the filter to 'port 1111 or port 2222' by using
> pcap_setfilter(). Is it possible that winpcap misses a packet on
> port 1111 during the filter exchange?
I would say "yes".
If I remember well, when you change the filter the kernel buffer is cleaned,
so all data in it is discarded.
If you had some packets that were captured but not yet delivered to the
application, these are lost.
This beaviour is needed, otherwise you may receive packets satifying the old
filter after setting the new one.
Cheers,
fulvio
> (Additional question: what is the filter expression for a port range?
> 'port 1111 or port 1112 or port 1113 or ... or port 2222')
>
> Thanks...
> Marc
>
>
>
>
> ==================================================================
> This is the WinPcap users list. It is archived at
> http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
>
> To unsubscribe use
> mailto: [EMAIL PROTECTED]
> ==================================================================
==================================================================
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use
mailto: [EMAIL PROTECTED]
==================================================================
