Gianluca Varenni wrote:
I can confirm that the source of the problem is 2, and it affects libpcap, as well, so the same problem seems to be present on the other OSes supported by libpcap.
Or, to be specific, on the other OSes supported by libpcap where
1) in-kernel filtering is done
and
2) more than one packet can be read from the kernel at a time
i.e., various BSDs (and AIX if BPF is being used), Digital/Tru64 UNIX, and Win32.
I've put Guy Harris in CC to this message,
I'm on winpcap-users, so I got the message anyway.
maybe he has a clue about it. My opinion is that this behavior is actually a bug that needs to be fixed. Guy, what do you think?
Yes, I'd call it a bug; I've checked in to pcap-bpf.c, pcap-pf.c, and pcap-win32.c in the libpcap CVS tree a change to set the character count value in the pcap_t structure to 0 (discarding anything read from the kernel) when the filter is changed.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
