<html>
<head>
</head>
<body class='hmmessage'><div dir='ltr'>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style>
<div dir="ltr"><p class="ecxMsoNormal"><font style="font-size: 10pt;" size="2">Hi </font></p><font style="font-size: 10pt;" size="2">
</font><p class="ecxMsoNormal"><font style="font-size: 10pt;" size="2">I’m trying to open more than one pcap dump file similar to
the following:</font></p><font style="font-size: 10pt;" size="2">
</font><p class="ecxMsoNormal"><font style="font-size: 10pt;" size="2"> </font></p>
<p class="ecxMsoNormal" style="text-indent:36.0pt;"><b><span style="font-size:10.0pt;font-family:"Courier New";">m_pcapout =
pcap_open_dead(DEFAULT_DLT_TYPE, SNAPLEN)</span></b></p><b>
</b><p class="ecxMsoNormal" style="text-indent:36.0pt;"><b><span style="font-size:10.0pt;font-family:"Courier New";">…</span></b></p><b>
</b><p class="ecxMsoNormal" style="text-indent:36.0pt;"><b><span style="font-size:10.0pt;font-family:"Courier New";">m_phandle1 =
pcap_dump_open(m_pcapout, file1)</span></b></p><b>
</b><p class="ecxMsoNormal" style="text-indent:36.0pt;"><b>…</b></p><b>
</b><p class="ecxMsoNormal" style="text-indent:36.0pt;"><b><span style="font-size:10.0pt;font-family:"Courier New";">m_phandle1 =
pcap_dump_open(m_pcapout, file2)</span></b></p><b>
</b><p class="ecxMsoNormal" style="text-indent:36.0pt;"><b>…</b></p><b>
</b><p class="ecxMsoNormal" style="text-indent:36.0pt;"><b><span style="font-size:10.0pt;font-family:"Courier New";">m_phandle1 =
pcap_dump_open(m_pcapout, file3)</span></b></p><b>
</b><p class="ecxMsoNormal" style="text-indent:36.0pt;"><b> </b></p>
<p class="ecxMsoNormal"><span style=""> </span><font style="font-size: 10pt;" size="2">note: fname1,fname2
and fnam3 </font><font style="font-size: 10pt;" size="2"><span style=""> </span></font><font style="font-size: 10pt;" size="2"><span style=""> </span></font><font style="font-size: 10pt;" size="2">are all different.</font></p>
<p class="ecxMsoNormal"> </p>
<p class="ecxMsoNormal"><font style="font-size: 10pt;" size="2">What I find however is </font><span style="font-size:10.0pt;font-family:"Courier New";">m_phandle1, m_phandle2, m_phandle3
all have the same value 0x1003D200. All pcap records written appear in only the last dumpfile opened – i.e. file3. The symptoms seem to be that one handle is being reopened/reused each time. Interestingly, for this example, file1
and file2 are both created and are 1K in size.</span></p>
<p class="ecxMsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";"> </span></p>
<p class="ecxMsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";">Looking at the source for pcap_dump_open() I cannot see why
this should not work. Am I missing some obvious point.</span></p>
<p class="ecxMsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";"> </span></p>
<p class="ecxMsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";">One further note: I am using winpcap version 4.1.2/4.1.3 on a
win7 machine and have tried the same executable on a winxp machine with identical results.<br></span></p><p class="ecxMsoNormal"><br><span style="font-size:10.0pt;font-family:"Courier New";"></span></p><p class="ecxMsoNormal"><br><span style="font-size:10.0pt;font-family:"Courier New";"></span></p><p class="ecxMsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";">Regards</span></p><p class="ecxMsoNormal"><br><span style="font-size:10.0pt;font-family:"Courier New";"></span></p><span style="font-size:10.0pt;font-family:"Courier New";">mks</span></div>
</div></body>
</html>