phengmaly peter wrote:
It seems to me, that the pcap_open_live's snaplen argument has only effect when a BPF filter is set thereafter (pcap_setfilter).
Is it the intended functionality ? (both 3.0 and 3.1b4)
At least on the original systems where BPF was implemented, the snapshot length was supplied by the BPF program; the "return" instruction in BPF includes a snapshot length value, which, if zero, means "discard this packet". On those systems, you need a BPF program to supply a snapshot length.
The WinPcap driver might follow that model, in which case you'd see that behavior, just as you would, for example, on various BSD systems.
On other systems, that's not the case. Perhaps libpcap should, when opening a device, install, on systems where the snapshot length comes from a BPF program, an initial BPF program that consists only of a "return" instruction with the specified snapshot length.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
