[Winpcap-users] Capturing only incoming packets

[Ramon Szmuk]

Hi Moshe,
If I understand right, you will listen on both interfaces and don't wan't to
have a duplicate of the traffic since it passes your PC twice (once for each
card)
so on each card just filter out traffic comming from the other one.
if the cards are A and B, when you listen on card A filter out card B MAC
address and
vice versa.

now you have filtered out the conversation between the cards.

or you can do a generic filter which demands that at least one MAC address
won't be
from A or B, logically something like:

not (ether host 0xaaaaaa and ether host 0xbbbbbb)

or maybe gateway will work for you:

not (gateway A or gateway B)

where "gateway host" is true if the packet used "host" as a gateway, meaning
the ethernet source or
destination address was "host" but neither the IP source nor the IP
destination was host
host is the host name not IP address.

if you still run into trouble write to me directly in hebrew as your name
indicates you are fluent in the language :)

Cheers,
Ramon Szmuk

----- Original Message ----- 
From: "Moshe Shaked" <mshaked at qualcomm.com>
To: <winpcap-users at winpcap.org>
Sent: Thursday, June 30, 2005 3:59 PM
Subject: Re: [Winpcap-users] Capturing only incoming packets


> Hi Ramon,
>
> Let me give you a brief description of what I'm trying to do.
> I wont to develop a repeater using the Winpcap.
> I took a PC with 2 Ethernet cards and each packet that received by one
card
> I'm sending it to the other.
> I want to capture only the incoming packet from each card, so when I will
> send the packets to the other card, I will not capture it (using one of
the
> capture function).
> Can it be done easily using WinPcap?
>
>
> thanks,
> Moshe
>
>
>
> At 04:10 PM 6/30/2005, you wrote:
> >Hi Moshe,
> >you can filter the capture with your MAC address
> >as the destination address, and you will receive only
> >packets sent to you.
> >if you are not working on Ethernet use any other second layer
> >address filter.
> >you can also filter with your ip set to destination, but I think
> >filters such as these should be made at the lowest level protocol
possible
> >
> >using windup you can write the filter as:
> >
> >ether dst=0xa2f2a2f2a2
> >
> >for example, where a2f2a2f2a2 is your ethernet MAC address
> >
> >
> >Cheers,
> >Ramon Szmuk
> >
> >----- Original Message -----
> >From: "Moshe Shaked" <mshaked at qualcomm.com>
> >To: <winpcap-users at winpcap.org>
> >Sent: Thursday, June 30, 2005 1:53 PM
> >Subject: [Winpcap-users] Capturing only incoming packets
> >
> >
> > > Hi All,
> > >
> > > It is possible to capture only the incoming packets and ignore the
> >outgoing
> > > packet from my PC?
> > >
> > >
> > >
> > > Thanks in advance,
> > > Moshe
> > >
> > > _______________________________________________
> > > Winpcap-users mailing list
> > > Winpcap-users at winpcap.org
> > > https://www.winpcap.org/mailman/listinfo/winpcap-users
> > >
> >
> >_______________________________________________
> >Winpcap-users mailing list
> >Winpcap-users at winpcap.org
> >https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>