Thanks for the suggestion. I see pcap_open_live(), that is called by pcap_open(), calls PacketSetHwFilter() with either NDIS_PACKET_TYPE_PROMISCUOUS or NDIS_PACKET_TYPE_ALL_LOCAL depending on whether it was asked to run in promiscuous mode. From ntddndis.h the only NDIS_PACKET* defines are:
// // Ndis Packet Filter Bits (OID_GEN_CURRENT_PACKET_FILTER). // #define NDIS_PACKET_TYPE_DIRECTED 0x00000001 #define NDIS_PACKET_TYPE_MULTICAST 0x00000002 #define NDIS_PACKET_TYPE_ALL_MULTICAST 0x00000004 #define NDIS_PACKET_TYPE_BROADCAST 0x00000008 #define NDIS_PACKET_TYPE_SOURCE_ROUTING 0x00000010 #define NDIS_PACKET_TYPE_PROMISCUOUS 0x00000020 #define NDIS_PACKET_TYPE_SMT 0x00000040 #define NDIS_PACKET_TYPE_ALL_LOCAL 0x00000080 #define NDIS_PACKET_TYPE_GROUP 0x00001000 #define NDIS_PACKET_TYPE_ALL_FUNCTIONAL 0x00002000 #define NDIS_PACKET_TYPE_FUNCTIONAL 0x00004000 #define NDIS_PACKET_TYPE_MAC_FRAME 0x00008000 --> none of which seems to be related to loopback. An interesting discussion at http://www.ndis.com/papers/loopback.htm says that the NDIS_FLAGS_IS_LOOPBACK_PACKET is set on received packets (obviously if it's a loopback packet). However, I don't see where I have access to the flag in WinPcap (especially running on Windows/XP). This same document says packets are always looped back when in promiscuous mode (which is how I am forced to be running). Rick ================================================================= This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ To unsubscribe use mailto: [EMAIL PROTECTED] =================================================================
