[Winpcap-users] Global port filter

[Gianluca Varenni]

----- Original Message ----- 
From: "Abhi" <acoknight at yahoo.com>
To: <winpcap-users at winpcap.org>
Sent: Sunday, December 16, 2007 8:33 PM
Subject: [Winpcap-users] Global port filter


> Hi,
>
> I am trying to modify wpcap to have a filter for certain ports only no
> matter what other filter is requested. The reason behind is an app which I
> cannot modify and which receives all captured traffic. I am trying to
> limit this traffic to certain ports eg using a filter "tcp portrange
> 2000-3000".
> I tried editing pcap_open and pcap_setfilter by adding pcap_compile and
> setting this filter, but it's still capturing everything.
> How could I go about adding a filter which would be in effect ignoring
> other filters requested?

You probably want to modify pcap_compile so that it appends the string "and 
tcp portrange 2000-3000" to all the filters that need to be compiled. This 
works if the application compiles a filter. Be careful because the empty 
string "" is a valid filter. In addition, I would add a 
pcap_compile/pcap_setfilter to the code of pcap_open_live, so that the 
global port filter is effective even if the application doesn't set a filter 
explicitely with pcap_setfilter.

Have a nice day
GV



>
> ps. os is windows xp, I have been compiling wpcap using the remote no
> airpcap.
>
> Thanx
>
>
>
>
>
>      ___________________________________________________________
> Yahoo! Answers - Got a question? Someone out there knows the answer. Try 
> it
> now.
> http://uk.answers.yahoo.com/
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users