[Winpcap-users] Strange behavior of pcap_next_ex

[Gianluca Varenni]

----- Original Message ----- 
From: "Jens Munk" <j.munk at maccor.com>
To: <winpcap-users at winpcap.org>
Sent: Thursday, December 04, 2008 7:04 AM
Subject: [Winpcap-users] Strange behavior of pcap_next_ex


> Hi,
>
> In my application, I am using pcap_sendpacket to send a raw packagage to
> a networked microcontroller that is within a millisecond or so sending
> another raw package as a reply (old microcontroller -> not IP), and I
> can verify with the WireShark that this is working just fine. However,
> the behavior of pcap_next_ex is not the way I expect. Due to its
> blocking nature I have it sitting in a separate thread, so that should
> be OK, but it doesn't return anything before it sees some kind of an IP
> message like an ARP. Then, however, it keeps returning all the raw
> messages since the last appearance of an IP message.
>
> Is this the way it is supposed to be or am I doing something wrong?
>

Please remember that there is a parameter called mintocopy. pcap_next_ex 
will not return until
- the timeout elapses (timeout that you chose in pcap_open_live)
- at least mintocopy bytes have been received (default value = 16000bytes)
(whatever happens first).

I would try to change the mintocopy value (pcap_setmintocopy) to a very 
small value and see what happens.

Have a nice day
GV


> FYI, I have this working using the lower level functions in the
> packet.dll, but I have previously been encouraged to use  wpcap.dll
> instead, so here I am.
>
> Regards,
>
> Jens.
>


--------------------------------------------------------------------------------


> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>