[Winpcap-users] can I change a filter during capture with WinPCapwithout losing packets?

[Gianluca Varenni]

Yes, you can definitely open two capture instances at the same time.

Have a nice day
GV

--------------------------------------------------
From: "Greg Hauptmann" <greg.hauptmann.ruby at gmail.com>
Sent: Thursday, August 19, 2010 1:44 PM
To: <winpcap-users at winpcap.org>
Subject: Re: [Winpcap-users] can I change a filter during capture with 
WinPCapwithout losing packets?

> thank GV,
>
> How about have a second instance of WinPCap capturing packets in
> parallel with the new filter for a short time, and then kill off the
> initial one?  Would WinPCap support this?
>
> thanks
>
>
> On 20 August 2010 03:55, Gianluca Varenni <gianluca.varenni at cacetech.com> 
> wrote:
>>
>>
>> --------------------------------------------------
>> From: "Greg Hauptmann" <greg.hauptmann.ruby at gmail.com>
>> Sent: Tuesday, August 17, 2010 6:53 PM
>> To: <winpcap-users at winpcap.org>
>> Subject: [Winpcap-users] can I change a filter during capture with
>> WinPCapwithout losing packets?
>>
>>> Hi,
>>>
>>> Can I change a filter during capture with WinPCap without losing
>>> packets?  Does WinPCap support this?
>>
>> No. When you change the filter, all the packets stored in the kernel 
>> buffer
>> at that specific time are dropped.
>>
>> Have a nice day
>> GV
>>
>>>
>>> thanks
>>> _______________________________________________
>>> Winpcap-users mailing list
>>> Winpcap-users at winpcap.org
>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>
>
>
> -- 
> Greg
> http://blog.gregnet.org/
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users