<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<STYLE type=text/css>DIV {
MARGIN: 0px
}
</STYLE>
<META content="MSHTML 6.00.6000.16441" name=GENERATOR></HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=hardik_nt@yahoo.com href="mailto:hardik_nt@yahoo.com">Hardik Shah</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, May 08, 2007 12:19
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Re:
Winpcap-users Digest, Vol 26, Issue 4</DIV>
<DIV><FONT size=2></FONT><BR></DIV>
<DIV
style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif">John,<BR><BR>filtering
at that level will affect the performance of overall system.better thing is to
let pcap capture all the data and then run the filtering on another </DIV>
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><FONT
face="Courier New" size=2></FONT> </DIV></BLOCKQUOTE>
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><FONT
face="Courier New" size=2>Uhm, what do you mean by "will affect the performance
of the overall system"? The filter code is usually lightweight enough not to be
the bottleneck even in case of long filters. if you bring all the packets to
user level the bottleneck (affecting the performance of the overall system)
can be the application itself and all the system calls you need to do to move
the packets to user level.</FONT></DIV>
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><FONT
face="Courier New" size=2>Have a nice day</FONT></DIV>
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><FONT
face="Courier New" size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif">module.because
more the flters you have more tedious it will become.<BR></DIV>
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif">--------------------------------<BR></DIV>
<DIV style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif">Hardik
Shah<BR><FONT size=3>mobile:- 9827634991</FONT><BR>phone:- +91-0731-2570516
</DIV>
<DIV
style="FONT-SIZE: 8pt; FONT-FAMILY: verdana,helvetica,sans-serif"><BR><BR>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman,new york,times,serif">-----
Original Message ----<BR>From: "winpcap-users-request@winpcap.org"
<winpcap-users-request@winpcap.org><BR>To:
winpcap-users@winpcap.org<BR>Sent: Saturday, 5 May, 2007 5:30:57
PM<BR>Subject: Winpcap-users Digest, Vol 26, Issue 4<BR><BR>
<DIV>Send Winpcap-users mailing list submissions
to<BR> winpcap-users@winpcap.org<BR><BR>To subscribe or
unsubscribe via the World Wide Web, visit<BR> <A
href="https://www.winpcap.org/mailman/listinfo/winpcap-users"
target=_blank>https://www.winpcap.org/mailman/listinfo/winpcap-users</A><BR>or,
via email, send a message with subject or body 'help'
to<BR> winpcap-users-request@winpcap.org<BR><BR>You can
reach the person managing the list
at<BR> winpcap-users-owner@winpcap.org<BR><BR>When
replying, please edit your Subject line so it is more specific<BR>than "Re:
Contents of Winpcap-users digest..."<BR><BR><BR>Today's
Topics:<BR><BR> 1. Changing WinPCAP Filters on the Fly (John
Hermanski)<BR><BR><BR>----------------------------------------------------------------------<BR><BR>Message:
1<BR>Date: Fri, 4 May 2007 11:43:21 -0400<BR>From: "John Hermanski"
<john.hermanski@eicon.com><BR>Subject: [Winpcap-users] Changing WinPCAP
Filters on the Fly<BR>To:
<winpcap-users@winpcap.org><BR>Message-ID:<BR> <E096369D937D3A4DB271B382850C5C5F019D40EE@pysmail.eicon.com><BR>Content-Type:
text/plain; charset="us-ascii"<BR><BR>Hi, <BR>I'm looking into using WinPCAP
for capturing and recording audio RTP<BR>streams. A single session, using a
precompiled filter works just fine.<BR>But in a "real" system, running
multiple sessions, packets being<BR>captured would change on a regular basis.
A stream can be uniquely<BR>identified by its source and destination UDP ports
and IP addresses. To<BR>capture streams for 25 calls, you would need to 'or'
together 25<BR>expressions.<BR>Would compiling an expression or putting it
into use break down when the<BR>expression got too large? <BR>When changing
compiled expressions while capture is going, can packets<BR>be lost?
<BR>Capturing everything, and then doing filtering myself is an option,
but<BR>probably not a good one. <BR>Thanks for any help or opinions
here.<BR><BR>JOHN HERMANSKI<BR>Applications Engineer<BR><BR>Dialogic Research
Inc.<BR><BR>Tel: (978) 744-9098<BR>Mobile: (978) 836-8028<BR>Email:
john.hermanski@dialogic.com<BR><mailto:tom.seidenstricker@dialogic.com>
<BR>Web: <A href="http://www.dialogic.com"
target=_blank>www.dialogic.com</A><BR><BR>This e-mail is intended only for the
named recipient(s) and may contain<BR>information that is privileged,
confidential and/or exempt from<BR>disclosure under applicable law. No waiver
of privilege, confidence or<BR>otherwise is intended by virtue of
communication via the internet. Any<BR>unauthorized use, dissemination or
copying is strictly prohibited. If<BR>you have received this e-mail in error,
or are not named as a recipient,<BR>please immediately notify the sender and
destroy all copies of this<BR>e-mail.<BR><BR><BR>-------------- next part
--------------<BR>An HTML attachment was scrubbed...<BR>URL: <A
href="http://www.winpcap.org/pipermail/winpcap-users/attachments/20070504/ec35ac66/attachment.html"
target=_blank>http://www.winpcap.org/pipermail/winpcap-users/attachments/20070504/ec35ac66/attachment.html</A><BR><BR>------------------------------<BR><BR>_______________________________________________<BR>Winpcap-users
mailing list<BR>Winpcap-users@winpcap.org<BR><A
href="https://www.winpcap.org/mailman/listinfo/winpcap-users"
target=_blank>https://www.winpcap.org/mailman/listinfo/winpcap-users</A><BR><BR><BR>End
of Winpcap-users Digest, Vol 26, Issue
4<BR>********************************************<BR></DIV></DIV><BR></DIV><BR>
<HR SIZE=1>
</HR>Here¢s a new way to find what you're looking for - <A
href="http://us.rd.yahoo.com/mail/in/yanswers/*http://in.answers.yahoo.com/">Yahoo!
Answers</A>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>