[Winpcap-users] Changing WinPCAP Filters on the Fly

[John Hermanski]

Hi, 
I'm looking into using WinPCAP for capturing and recording audio RTP
streams. A single session, using a precompiled filter works just fine.
But in a "real" system, running multiple sessions, packets being
captured would change on a regular basis. A stream can be uniquely
identified by its source and destination UDP ports and IP addresses. To
capture streams for 25 calls, you would need to 'or' together 25
expressions.
Would compiling an expression or putting it into use break down when the
expression got too large? 
When changing compiled expressions while capture is going, can packets
be lost? 
Capturing everything, and then doing filtering myself is an option, but
probably not a good one. 
Thanks for any help or opinions here.

JOHN HERMANSKI
Applications Engineer

Dialogic Research Inc.

Tel: (978) 744-9098
Mobile: (978) 836-8028
Email: john.hermanski at dialogic.com
<mailto:tom.seidenstricker at dialogic.com> 
Web: www.dialogic.com

This e-mail is intended only for the named recipient(s) and may contain
information that is privileged, confidential and/or exempt from
disclosure under applicable law. No waiver of privilege, confidence or
otherwise is intended by virtue of communication via the internet. Any
unauthorized use, dissemination or copying is strictly prohibited. If
you have received this e-mail in error, or are not named as a recipient,
please immediately notify the sender and destroy all copies of this
e-mail.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20070504/ec35ac66/attachment.htm