[Winpcap-users] WinPCap & Managed Extensions

[Bryan Kadzban]

Loris Degioanni wrote:
> If I remember well, the article at:
> 
> http://www.codeproject.com/dotnet/dotnetwinpcap.asp
> 
> explains how to use WinPcap from .net.

... Now that I think about it, I think I know what the problem in this
thread is.  It's probably that either the NPF or NM driver (or both)
haven't been started before Alessandro's service tries to start.

The main WinPcap DLL starts NPF when it gets loaded, and one of the
dependencies of wanpacket.dll starts NM when it gets loaded.  If the
service's executable explicitly links against the WinPcap DLLs (which I
think you can do in C++, but not C# or VB.net), then the service process
itself will load those DLLs when it starts, which will try to start both
of those drivers.

But the drivers take a *long* time to start (at least on 2000 Pro),
because the OS is under heavy service-start load at boot time.

The solution is to either mark your service as depending on both NPF and
NM, or mark NPF and NM as "system" or (maybe) "boot".  That will make
them start before the service's EXE even tries to load, so the DLL load
time will be drastically reduced.  So the service will be able to call
StartServiceCtrlDispatcher earlier, and not have its process killed by SCM.

To mark them as system (again, on 2K Pro), bring up device manager,
select View -> Show nonpresent devices, then expand "non-PnP devices"
and go to the properties on both the "NetGroup Packet Filter" and
"Network Monitor" items, then go to the "Driver" tab inside the dialog,
and change the startup type from "Demand" to "System" on both items.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 256 bytes
Desc: OpenPGP digital signature
Url : http://www.winpcap.org/pipermail/winpcap-users/attachments/20051011/d3e41a33/signature.pgp