[Winpcap-users] can I change a filter during capture with WinPCapwithout losing packets?

[Greg Hauptmann]

thank GV,

How about have a second instance of WinPCap capturing packets in
parallel with the new filter for a short time, and then kill off the
initial one?  Would WinPCap support this?

thanks


On 20 August 2010 03:55, Gianluca Varenni <gianluca.varenni at cacetech.com> wrote:
>
>
> --------------------------------------------------
> From: "Greg Hauptmann" <greg.hauptmann.ruby at gmail.com>
> Sent: Tuesday, August 17, 2010 6:53 PM
> To: <winpcap-users at winpcap.org>
> Subject: [Winpcap-users] can I change a filter during capture with
> WinPCapwithout losing packets?
>
>> Hi,
>>
>> Can I change a filter during capture with WinPCap without losing
>> packets?  Does WinPCap support this?
>
> No. When you change the filter, all the packets stored in the kernel buffer
> at that specific time are dropped.
>
> Have a nice day
> GV
>
>>
>> thanks
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>



-- 
Greg
http://blog.gregnet.org/