[Winpcap-users] Urgent - Why the IPv6 packets are filtered out?

[Bassam A. Al-Khaffaf]

Hi and thanks for your response.

 

I use the same filter string with tcpdump in order to capture the IPv4 and
IPv6 traffic targeted to ports 1812 and 1813 with no problem.

 

I am 100% sure that this is a bug in winpcap.

 

I wonder if there is something that I can combine into my code in order to
capture the traffic from all the Interfaces in the same time in multihomed
machine.

 

In fact I am writing a network application "Radius" using win32 C++ with
visual C++ express edition, and I need to capture the source and destination
MAC and IP/IPv6 addresses from any request targeted to a multihomed machine

 

Regards

Bassam

 

  _____  

From: Gianluca Varenni [mailto:gianluca.varenni at cacetech.com] 
Sent: Friday, January 19, 2007 1:08 AM
To: bassam at palettemm.com; winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Urgent - Why the IPv6 packets are filtered out?

 

Have you tried capturing with that same filter with tcpdump or wireshark and
see if the ipv6 packets are captured or not?

 

I suspect a bug in the pcap filter compiler.

 

Have a nice day

GV

 

----- Original Message ----- 

From: Bassam A. <mailto:bassam at palettemm.com>  Al-Khaffaf 

To: winpcap-users at winpcap.org 

Sent: Tuesday, January 16, 2007 10:11 PM

Subject: [Winpcap-users] Urgent - Why the IPv6 packets are filtered out?

 

Dear Folk,

 

   Please need your urgent help. I am using Winpcap 4.0 beta 3 developer's
pack version to capture the Ethernet and IPv4/IPv6 headers in order to
extract the MAC and IP addresses into my network application. The capturing
operation is working fine, I mean capturing MAC and both IPv4/IPv6
addresses. However, when I try to filter out the traffic using both
pcap_compile() and pcap_setfilter() functions along with the filter string
"udp dst port 1812 or udp dst port 1813", Winpcap will no more show the IPv6
traffic, it shows only the IPv4 traffic destined to the two mentioned ports.

 

If I changed the filter string to "ip or ip6", it will work fine but the
problem here that the traffic destined not to the mentioned port will be
captured as well

 

The filtering part code snippet as shown here:

 

/***************************************************************************
**************/

    //The device is already opend

 

    if (d->addresses != NULL)

        /* Retrieve the mask of the first address of the interface */

        netmask=((struct sockaddr_in
*)(d->addresses->netmask))->sin_addr.S_un.S_addr;

    else

        /* If the interface is without an address we suppose to be in a C
class network */

        netmask=0xffffff; 

 

    //compile the filter 

    if (pcap_compile(adhandle, &fcode, "dst port 1812 or dst port 1813", 0,
netmask) < 0)

    {

        cerr << "\nUnable to compile the packet filter. Check the syntax."
<< endl;

        /* Free the device list */

        pcap_freealldevs(alldevs);

        return -1;

    }

    

    //set the filter

    if (pcap_setfilter(adhandle, &fcode) < 0)

    {

        cerr << "\nError setting the filter." << endl;

        /* Free the device list */

        pcap_freealldevs(alldevs);

        return -1;

    }

 

   //Rest of code

/***************************************************************************
**************/

 

 

Now if I comment out this part, I will be able to capture all the traffics
includeing IPv6.

 

I need your argent help and it is much appreciated.

 

Regards

Bassam


  _____  


_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20070119/35042ebd/attachment.htm