<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>Changing WinPCAP Filters on the Fly</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Hi,</FONT><FONT FACE="Times New Roman"> </FONT>
<BR><FONT SIZE=2 FACE="Arial">I'm looking into using WinPCAP for capturing and recording audio RTP streams. A single session, using a precompiled filter works just fine.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">But in a "real" system, running multiple sessions, packets being captured would change on a regular basis. A stream can be uniquely identified by its source and destination UDP ports and IP addresses. To capture streams for 25 calls, you would need to 'or' together 25 expressions.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Would compiling an expression or putting it into use break down when the expression got too large?</FONT><FONT FACE="Times New Roman"> </FONT>
<BR><FONT SIZE=2 FACE="Arial">When changing compiled expressions while capture is going, can packets be lost?</FONT><FONT FACE="Times New Roman"> </FONT>
<BR><FONT SIZE=2 FACE="Arial">Capturing everything, and then doing filtering myself is an option, but probably not a good one.</FONT><FONT FACE="Times New Roman"> </FONT>
<BR><FONT SIZE=2 FACE="Arial">Thanks for any help or opinions here.</FONT>
</P>
<P><FONT COLOR="#000080" SIZE=2 FACE="Arial">JOHN HERMANSKI</FONT><BR>
<FONT COLOR="#808080" SIZE=2 FACE="Arial">Applications Engineer<BR>
<BR>
</FONT><FONT COLOR="#808080" FACE="Arial">Dialogic Research Inc.<BR>
<BR>
</FONT><FONT COLOR="#808080" SIZE=2 FACE="Arial">Tel:</FONT><FONT COLOR="#0000FF" SIZE=2 FACE="Arial"></FONT> <FONT COLOR="#000080" SIZE=2 FACE="Arial">(978) 744-9098<BR>
</FONT><FONT COLOR="#808080" SIZE=2 FACE="Arial">Mobile:</FONT> <FONT COLOR="#000080" SIZE=2 FACE="Arial">(978) 836-8028<BR>
</FONT><FONT COLOR="#808080" SIZE=2 FACE="Arial">Email:</FONT><FONT COLOR="#000080" SIZE=2 FACE="Arial"> john.hermanski</FONT><A HREF="mailto:tom.seidenstricker@dialogic.com"><U><FONT COLOR="#000080" SIZE=2 FACE="Arial">@dialogic.com</FONT></U></A><BR>
<FONT COLOR="#808080" SIZE=2 FACE="Arial">Web:</FONT><FONT COLOR="#000080" SIZE=2 FACE="Arial"> </FONT><A HREF="file://www.dialogic.com"><U></U><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">www.dialogic.com</FONT></U></A><BR>
<BR>
<FONT COLOR="#808080" SIZE=2 FACE="Arial">This e-mail is intended only for the named recipient(s) and may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. No waiver of privilege, confidence or otherwise is intended by virtue of communication via the internet. Any unauthorized use, dissemination or copying is strictly prohibited. If you have received this e-mail in error, or are not named as a recipient, please immediately notify the sender and destroy all copies of this e-mail.</FONT></P>
<BR>
</BODY>
</HTML>