<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"OCR A Extended";
panose-1:2 1 5 9 2 1 2 1 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hi,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> I
am developing a winpcap library in C# with visual studio 2005 (and using the
version 3.1 of winpcap) and the pcap_list_datalinks function return the value
2, indicating the number of datalinks it found, but the array return only one
element. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> I
declared the import with this :<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=1
face="OCR A Extended"><span style='font-size:8.0pt;font-family:"OCR A Extended";
background:white'> <font
color=green><span style='color:green'>// WinPCap : int
pcap_list_datalinks(pcap_t *p, int **dlt_buf)<o:p></o:p></span></font></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=1
face="OCR A Extended"><span style='font-size:8.0pt;font-family:"OCR A Extended";
background:white'> [<font
color=teal><span style='color:teal'>DllImport</span></font>(<font color=maroon><span
style='color:maroon'>"wpcap.dll"</span></font>,CharSet=<font
color=teal><span style='color:teal'>CharSet</span></font>.Ansi)]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="OCR A Extended"><span style='font-size:
8.0pt;font-family:"OCR A Extended";background:white'>
<font color=blue><span style='color:blue'>internal</span></font> <font
color=blue><span style='color:blue'>extern</span></font> <font color=blue><span
style='color:blue'>static</span></font> <font color=blue><span
style='color:blue'>int</span></font> pcap_list_datalinks(<font color=teal><span
style='color:teal'>IntPtr</span></font> pcapT, <font color=blue><span
style='color:blue'>ref</span></font> <font color=blue><span style='color:blue'>int</span></font>[]
dlt_buf);</span></font><font size=1 face="OCR A Extended"><span
style='font-size:8.0pt;font-family:"OCR A Extended"'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="OCR A Extended"><span style='font-size:
8.0pt;font-family:"OCR A Extended"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> And
the code to retrieve the links is :<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=1
face="OCR A Extended"><span style='font-size:8.0pt;font-family:"OCR A Extended";
background:white'>
<font color=teal><span style='color:teal'>IntPtr</span></font>
pcapT=OpenDevice(Target,Auth);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=1
face="OCR A Extended"><span style='font-size:8.0pt;font-family:"OCR A Extended";
background:white'>
<font color=blue><span style='color:blue'>int</span></font>[] links=<font
color=blue><span style='color:blue'>new</span></font> <font color=blue><span
style='color:blue'>int</span></font>[] {};<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="OCR A Extended"><span style='font-size:
8.0pt;font-family:"OCR A Extended";background:white'>
<font color=blue><span style='color:blue'>int</span></font> result=<font
color=teal><span style='color:teal'>NativeMethods</span></font>.pcap_list_datalinks(pcapT,<font
color=blue><span style='color:blue'>ref</span></font> links);</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> The
value return into result is 2, but the links array only have one value (1 for Ethernet).<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> The
detailed information returned by ethereal for the same network adapter (path : capture->interfaces->details)
return only one media supported (I suppose this is the name they use for
datalink).<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> I
first thought it was because I used 32bits integer for my array, but the
symptoms are the same with 16bits bytes.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> So,
either the returned value is wrong, or I’m missing a datalink in my
array, or I’m doing something wrong in the code.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> Someone
have an idea before I dig into the winpcap source code?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>