[Winpcap-users] WINPCAP issue with Microsoft C# (VS 2005)

[Gianluca Varenni]

Chris,

my suspect is that the calling convention of the delegate that you pass to pcap_loop or pcap_dispatch is wrong. As a consequence, on return from the first call to the callback/delegate, the stack becomes somewhat corrupted, causing the problems you are seeing.

I found this interesting article on CodeProject that may help you in solving this problem (the solution is not so easy, as it forces you to basically modify the MSIL).

http://www.codeproject.com/dotnet/Cdecl_CSharp_VB.asp

Let me know if it helps.

In any case, I would suggest you to use the pcap_next_ex function, it's usually much easier to use.

Have a nice day
GV

  ----- Original Message ----- 
  From: Chris Boebel 
  To: winpcap-users at winpcap.org 
  Sent: Sunday, April 09, 2006 7:35 AM
  Subject: [Winpcap-users] WINPCAP issue with Microsoft C# (VS 2005)


  Greetings -

  I have encountered a problem using winpcap 3.1 from Microsoft's C# (Visual Sutdio 2005). 

  I have seen the issue reported on the web, but after much searching I have not found an answer. Hopefully, someone here will know.

  Essentailly, the callback function is called properly for the first packet. When it is called for the second packet, some strange behaviour can be seen.
  First, caplen in the header structure is set to the timeout value set when calling pcap_open_live. len is set to zero. Additionally, the data pointer comes back with the number of packets to capture (sent to pcap_dispatch). 

  For example, if pcap_open_live is called with a timeout value of 5000, caplen comes back as 5000. If pcap_dispatch is called with the number of packets as 10, the pointer to the data comes back as equal to 10.

  Looking at the pcap structure, I'm wondering if something is messing with the data contained therein between the first and second calls to the callback function.

  Any thoughts? I would be much obliged.

  I should point out that using pcap_next_ex instead of dispatch or loop works just fine. Being that pcap_next_ex is just a wrapper for dispatch, it must be something that C# is doing.

  Thank you
  Chris


------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20060411/351a5e3b/attachment.htm