<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2802" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>Chris,</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>my suspect is that the calling convention of the delegate that
you pass to pcap_loop or pcap_dispatch is wrong. As a consequence, on return
from the first call to the callback/delegate, the stack becomes somewhat
corrupted, causing the problems you are seeing.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>I found this interesting article on CodeProject that may help
you in solving this problem (the solution is not so easy, as it forces you to
basically modify the MSIL).</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2><A
href="http://www.codeproject.com/dotnet/Cdecl_CSharp_VB.asp">http://www.codeproject.com/dotnet/Cdecl_CSharp_VB.asp</A></FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Let me know if it helps.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>In any case, I would suggest you to use the pcap_next_ex
function, it's usually much easier to use.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=cboebel@gmail.com href="mailto:cboebel@gmail.com">Chris Boebel</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Sunday, April 09, 2006 7:35
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] WINPCAP issue
with Microsoft C# (VS 2005)</DIV>
<DIV><BR></DIV>
<DIV>Greetings -</DIV>
<DIV> </DIV>
<DIV>I have encountered a problem using winpcap 3.1 from Microsoft's C#
(Visual Sutdio 2005). </DIV>
<DIV> </DIV>
<DIV>I have seen the issue reported on the web, but after much searching I
have not found an answer. Hopefully, someone here will know.</DIV>
<DIV> </DIV>
<DIV>Essentailly, the callback function is called properly for the first
packet. When it is called for the second packet, some strange behaviour can be
seen.</DIV>
<DIV>First, caplen in the header structure is set to the timeout value set
when calling pcap_open_live. len is set to zero. Additionally, the data
pointer comes back with the number of packets to capture (sent to
pcap_dispatch). </DIV>
<DIV><BR>For example, if pcap_open_live is called with a timeout value of
5000, caplen comes back as 5000. If pcap_dispatch is called with the number of
packets as 10, the pointer to the data comes back as equal to 10.</DIV>
<DIV> </DIV>
<DIV>Looking at the pcap structure, I'm wondering if something is messing with
the data contained therein between the first and second calls to the callback
function.</DIV>
<DIV> </DIV>
<DIV>Any thoughts? I would be much obliged.</DIV>
<DIV> </DIV>
<DIV>I should point out that using pcap_next_ex instead of dispatch or loop
works just fine. Being that pcap_next_ex is just a wrapper for dispatch, it
must be something that C# is doing.</DIV>
<DIV> </DIV>
<DIV>Thank you</DIV>
<DIV>Chris</DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>