<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Sent again, as I don't receive the copy from the list.<br> <BR><div><hr id="stopSpelling">From: carpe7@hotmail.com<br>To: winpcap-users@winpcap.org<br>Subject: Service crash after update to WinPcap networking<br>Date: Fri, 28 Mar 2014 10:07:37 +0000<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Hi,<br> <br>We have updated the raw socket networking subsystem of a Windows service to WinPcap, with the following architecture:<br>-- One thread continuously captures on its own pcap_t calling pcap_next_ex.<br>-- Several threads send packets concurrently over the same interface, but each one with it own private pcap_t obtained from pcap_open. These threads call pcap_sendpacket.<br> <br>Since the update, the service crashes intermittently, although only one of the two servers in a redundant cluster exhibit the problem.<br>We are logging the errors produced by WinPcap. For that, after pcap_sendpacket returning a negative result we call pcap_geterr.<br> <br>Just before the crash, the service logs (pcap_geterr result):<br> <br><em>send error: PacketSendPacket failed</em><br><em></em> <br>In EventViewer, this is the detail of the crash:<br> <br><em>Faulting application name: ...<br>Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e<br>Exception code: 0xc0000374<br>Fault offset: 0x00000000000c40f2<br>Faulting process id: 0x1d64<br>Faulting application start time: 0x01cf4a53bf7cfe86<br>Faulting application path: ...<br>Faulting module path: C:\Windows\SYSTEM32\ntdll.dll<br>Report Id: 0e886882-b656-11e3-b6bb-e4115be757a8</em><br><em></em> <br>The OS is Windows Server 2008 R2 64 bits.<br>The WinPcap version is 4.1.3.<br><em></em> <br>The question is: has someone observed this problem?<br> <br>Thank you very much.<br> <br>Regards,<br>J.M.<br> </div></div> </div></body>
</html>