[Winpcap-users] Can I capture inbound packets only?

[Ben Greear]

Greg Watson wrote:
> Hello,
> 
> I saw this question asked a few months ago by someone else, but with no 
> response. I'm hoping someone can provide a definitive answer.
> 
> I would like to set pcap to capture inbound packets only, not outbound.
> 
> Why? Because we use it to test Ethernet switches created by students: we 
> use a 4-port NIC connected to a 4-port ethernet switch designed by the 
> students (FPGAs).
>                  +--------------+
> NIC_port0 <----> | Switch_port0 |
> NIC_port1 <----> | Switch_port1 |
> NIC_port2 <----> | Switch_port2 |
> NIC_port3 <----> | Switch_port3 |
>                  +--------------+
> 
> We test the switch by sending packets to it and we capture the response 
> packets. Because it is a switch then packets come back completely 
> unmodified. Therefore we expect to receive packets we have sent, indeed 
> we expect to receive ONLY packets we have sent.
> 
> It really complicates life if we capture the packets we send as we 
> cannot tell if a captured packet was transmitted by us or received by us.
> 
> Note: we might well have a packet sent back to us ON THE SAME PORT that 
> we sent it out on - this is an error (switches must not do this) but 
> then these are student designs and sometimes they make mistakes.

Use PF_PACKET sockets on linux, or get the OEM winpcap library from CACE
which allows you to not capture out-going packets.  (I use both with good
results.)

Ben

> 
> Thanks for any help.
> 
> -Greg
> 
> 
> 
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
> 


-- 
Ben Greear <greearb at candelatech.com>
Candela Technologies Inc  http://www.candelatech.com