[Winpcap-users] Regarding sniffing on multiple interfaces.

[Guy Harris]

On Jun 21, 2010, at 3:50 AM, Mygapula, Sudheer IN BLR SISL wrote:

> 
> Can any body explain how to implement poll\ select concept to capture packet from all available NIC?
> 
> OS version: windows.

Nobody can, because Windows doesn't have poll(), and select() only applies to WinSock sockets, not to the devices that are used to implement capturing in WinPcap.

As I said in my earlier response to you:

> Otherwise, you will have to open each device separately, and use either select() or poll() (NOTE: poll() won't work for pcap captures on any version of Mac OS X prior to 10.6) ***on UN*X***, ***or WaitForMultipleObjects() on Windows*** (with WinPcap), to wait for one or more of the pcap_t's to have packets available.

so if you're using Windows, you need to use WaitForMultipleObjects():

	http://msdn.microsoft.com/en-us/library/ms687025(VS.85).aspx

or MsgWaitForMultipleObjects():

	http://msdn.microsoft.com/en-us/library/ms684242(VS.85).aspx

depending on whether your program is a GUI application or not.  You will need to use pcap_gethandle():

	http://www.winpcap.org/docs/docs_411/html/group__wpcapfunc.html#g2c415e9192c7b18a81a02300ae6f2c02

to get the handles to pass to WaitForMultipleObjects() or MsgWaitForMultipleObjects().  (Yes, they say

	We disourage the use of this function because it is not portable.

but there *is* no way to do this that's portable between UN*X and Windows - the only reason to use pcap_gethandle() is if you need to do something that can't be done portably.)