<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>For all practical purposes it is most important to be notified that the link state has changed. If that takes some seconds to find out it is certainly better than not finding out at all…<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></a></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b>On Behalf Of </b>Sven Kerschbaum<br><b>Sent:</b> Friday, February 5, 2016 8:27 AM<br><b>To:</b> Jiyang Hu <jiyang_hu@yahoo.com>; winpcap-users@winpcap.org<br><b>Subject:</b> Re: [Winpcap-users] Windows 10 support for WinPcap<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p>I cannot find any information about the function IoctlNdisQueryGlobalStats(...). Do you have a link? I agree that is not an option to query the media state in a loop. I have a working solution using WMI but the notification is not in real-time. I sometimes experience a delay of a few seconds... <o:p></o:p></p><div style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt'><div><div><div><p class=MsoNormal style='background:white'><span style='font-size:13.5pt;color:black'>I believe query NDIS for OID_GEN_MEDIA_CONNECT_STATUS is a waste of resource if it is put in a loop. Getting a notification of media state change asynchronously should be better. My 2 cents.</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt;background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p></div><div><div><div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:black'>On Friday, February 5, 2016 9:23 AM, Nuno Antonio Dias Ferreira <<a href="mailto:nuno.ferreira@efacec.com">nuno.ferreira@efacec.com</a>> wrote:</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><p class=MsoNormal style='margin-bottom:12.0pt;background:white'><span style='font-family:"Helvetica",sans-serif;color:black'><o:p> </o:p></span></p><div><div><div><div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>Hi Sven,</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>I have an application where I am using npcap and I also have the need to detect the media status changes. To do that I query NDIS to get that information: <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff569604(v=vs.85).aspx">https://msdn.microsoft.com/en-us/library/windows/hardware/ff569604(v=vs.85).aspx</a></span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>Here is an example:</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='text-indent:35.4pt;background:white'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'>if(IoctlNdisQueryGlobalStats(Iface->IOCTLhandler, OID_GEN_MEDIA_CONNECT_STATUS, &ConnectedState, </span><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:blue'>sizeof</span><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'>(ConnectedState), (PUINT)&ReturnedCount) == ERROR_SUCCESS)</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'> {</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:blue'>return</span><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'> ConnectedState == NdisMediaStateConnected;</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'> }</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>Hope this information could be helpful.</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:8.0pt;font-family:"Helvetica",sans-serif;color:black'>Melhores Cumprimentos / Best Regards</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:8.0pt;font-family:"Helvetica",sans-serif;color:black'>Nuno Antonio Dias Ferreira<br>Unidade de Automação de Sistemas de Energia / Power System Automation Unit</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:8.0pt;font-family:"Helvetica",sans-serif;color:black'>Efacec Energia, Máquinas e Equipamentos Elétricos, S.A.<br></span><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'><img border=0 width=107 height=44 id="_x0000_i1025" src="cid:image001.jpg@01D15FF7.A36681E0" alt="EFA Logo"></span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:8.0pt;font-family:"Helvetica",sans-serif;color:black'>Disclaimer</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><div><p class=MsoNormal style='background:white'><b><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>From:</span></b><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> <a href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</a> [mailto:<a href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</a>] <b>On Behalf Of </b>?????V5<br><b>Sent:</b> 5 de fevereiro de 2016 04:44<br><b>To:</b> <a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a><br><b>Subject:</b> Re: [Winpcap-users] Windows 10 support for WinPcap</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>On Fri, Feb 5, 2016 at 3:56 AM, Mark Pizzolato - Winpcap-Users <<a href="mailto:winpcap-users-20040408@subscriptions.pizzolato.net">winpcap-users-20040408@subscriptions.pizzolato.net</a>> wrote:<o:p></o:p></span></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>The inverted call model might be useful in an abstract way to get notified of a media </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>state change, however, the question then comes back to how to convey that detail </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>to the application which is using the libpcap APIs. </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>Since the only APIs that an application which already has a pcap session opened </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>is using are: pcap_next_ex, pcap_dispatch, pcap_loop and possibly </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>pcap_sendpacket</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>pcap_next_ex, pcap_dispatch and pcap_loop are defined to return -1 on an error. </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>Is media state change an error?</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> Is media offline an error?</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div></div></div></blockquote><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>I prefer to use the phrases in ncpa.cpl.<o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>If the adapter disconnects (like Wi-Fi), libpcap API should only report time-out (you don't get any new packets).<o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>If the adapter is disabled, libpcap API may report error (or time-out)? I didn't try this. One thing for sure is that you can't get new packets too. This thing should not happen when using Npcap/WinPcap. Because when listing adapters with Npcap/WinPcap, disabled adapters never show up on the list. So Npcap/WinPcap assumes that the adapters it uses is always kept as enabled.<o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>pcap_sendpacket is defined to return -1 if a packet wasn’t successfully sent.</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> It would seem that returning -1 when the media is offline makes sense</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div></div></div></blockquote><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>This makes sense to me.<o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>I don’t know for sure how WinPcap behaves under these conditions, but it </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>seems that it npcap should reliably report errors under the media offline state.</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal style='background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'>Is there a reason it can’t?</span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div></div></div></blockquote><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'>Npcap actually doesn't report errors any better than WinPcap. There's even a chance that Npcap behaves different on reporting errors with WinPcap. Because Npcap uses NDIS6 and WinPcap uses NDIS5.<o:p></o:p></span></p></div></div><div><div><p class=MsoNormal style='background:white'><span style='font-family:"Helvetica",sans-serif;color:black'> <o:p></o:p></span></p></div></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><div><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div><div><div><div style='margin-bottom:12.0pt'><p class=MsoNormal style='margin-left:27.6pt;background:white'><span style='font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black'> </span><span style='font-family:"Helvetica",sans-serif;color:black'><o:p></o:p></span></p></div></div></div></div></div></div></div></div></blockquote></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></body></html>