[Winpcap-users] winpcap and ip change

[Gianluca Varenni]

Does it happen on all the Windows versions? I'm particularly interested if 
this happens on pre vista and vista(or greater).

In general, changing the IP address should not cause this effect (it's 
something inside the tcp/ip stack, WinPcap works in parallel with it). 
Unless the IP address change causes some changes in some NDIS intermediate 
driver (so below WinPcap) and there is some unbinding/binding going on.

Aftet the IP change, do you capture *any* packet with WinPcap?

Have a nice day
GV

--------------------------------------------------
From: "Thorsten Stoffregen" <thorsten.stoffregen at gmx.de>
Sent: Thursday, September 23, 2010 10:47 AM
To: <winpcap-users at winpcap.org>
Subject: Re: [Winpcap-users] winpcap and ip change

> Hi David,
>
> thanks for your replay.
> Yes, Profinet depends on TCP/IP but it alsp uses
> special ethernet frames for real-time
> communication. That makes it really fast
> (about 1 millisecond cycle Time).
>
> Let say you have a robot-arm.
> TCP/IP itself is needed for configuration of the robot.
>
> But the real action - the movement - happens on low level with
> ethernet frames only, without an overlying protocol.
> For this reason I use WinPcap to capture these packages.
> So far it works like a charm.
>
> But now there are ethernet-profinet packages who say:
> Ok, Adapter with mac Foo has now IP Bar
> (The concept is similar to DHCP).
> So I need to reconfigure the Windows IP Stack and keep listening
> to the Low-Level Packages. And after the IP change I don't
> get the Low Level Packages with WinPcap. TCP/IP and other services
> are working well.
>
> I found the following solution:
> Close and reopen the capture device with pcap:
>
> pcap_close(pcap_t ...);
> changeIp(.....);
> Sleep(5000);
> pcap_open(pcap_t ...);
>
> But now I have to wait several seconds between close and open!
> Without the Waiting it will not work, wait for 5 seconds
> and it works. So it's a solution, but waiting for 5 seconds....
> Seems not a very good solution for me.
>
> Is there a way to explicit re-initialise the kernel driver?
> Or even better, to let him do it by himself ;-)
>
>
>
> ----- Ursprüngliche Mail -----
>> Thorsten Stoffregen wrote:
>>
>> > Hi,
>> >
>> > I am building an application which listen to Level 2
>> > Realtime Traffic. My problem is, that the overlying
>> > application has to change the ip address of the interface
>> > on which I am listening with pcap.
>> >
>> > After changing the ip I there are packets missing in the
>> > capture. Especially pakets with Ethernet.Type = 0x8892
>> > (Profinet), standard traffic like arp request is still
>> > visible.
>>
>> PROFINET appears to be a TCP/IP protocol:
>>
>> http://en.wikipedia.org/wiki/PROFINET
>>
>> As such, it likely depends on a valid IP address in order to work
>> correctly,
>> yes?
>>
>> Since you're changing the IP address of the adapter it's hardly
>> surprising
>> that Profinet packets are being lost.
>>
>> ARP does not rely on IP. That's why it continues to work, regardless
>> of what
>> the adapter's IP address is.
>>
>> Do you have any documentation on Profinet? What its various packet
>> layouts
>> looks like?
>>
>> --
>> "Fish" (David B. Trout)
>> fish at softdevlabs.com
>>
>>
>>
>>
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>