<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16587" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>Can you please try wrapping all the calls to pcap_compile()
with a critical section or a mutex? That API is not thread safe i.e. if you
happen to call that function concurrently from multiple threads, the result is
undefined.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Paul.Rocca@audiosoft.co.uk
href="mailto:Paul.Rocca@audiosoft.co.uk">Paul Rocca</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, January 08, 2008 5:07
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Opening a port
multiple times and filters</DIV>
<DIV><BR></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>I am wrining an app to capture various multicast
streams to seperate files.</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>In order to make my program easier to write I have 1
thread per stream, and</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>open the NIC card multiple times and pull out
the packets and filter them</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>in my code using src/dst ip addresses. This appears
to work great, but</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>a bit CPU intensive. </SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>I thought it might be easier then to use the winpcap
filter function, so I wrote</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>a bit of code to do this and that initially appeared
to work great, BUT</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>on further investigation, it would appear that
winpcap only uses the last</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>filter that was set with pcap_setfilter.
i.e.</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>if I have three threads and in in each one I
open an instances of my port and</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>in each thread set a filter on each one (eg
thread 1 = 'dst ip 225.0.0.1', </SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>thread 2 = 'dst ip 225.0.0.2', thread
3 = 'dst ip 225.0.0.3'), then start calling</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>pcap_next_ex() in each thread, all three threads will
only receive packets</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>matching 'dst ip
225.0.0.3'</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008></SPAN></SPAN></STRONG> </DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>Is this "as designed"?, any ideas for a workaround,
or is it back to filtering</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>in my software?</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008></SPAN></SPAN></STRONG> </DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>TIA</SPAN></SPAN></STRONG></DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008></SPAN></SPAN></STRONG> </DIV>
<DIV><STRONG><SPAN lang=EN-GB
style="FONT-WEIGHT: normal; FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-ansi-language: EN-GB"><SPAN
class=988025412-08012008>Paul</SPAN></SPAN></STRONG></DIV><BR>_______________________________________________________________________<BR>This
e-mail has been scanned for all viruses by Star Internet. The<BR>service is
powered by
MessageLabs.<BR>_______________________________________________________________________<BR>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>