[Winpcap-users] winpcap and ip change

[Thorsten Stoffregen]

So far I tested only on Windows 7, I am not until 
Monday in the lab again. Then I can write an demo which send
such packages.

I testet with wireshark and netsh tool, same behavior... 
packets are on the
network (captured with another pc and mirror-switch) but doesn't
show in the capture.
I've seen quite a lot other (non-Profinet) packages, but now
I'm not quite sure if these where only broadcast or direct 
addressed to the interface.

On Monday I will write a simple demo and look further into 
this.

----- Ursprüngliche Mail -----
> Does it happen on all the Windows versions? I'm particularly
> interested if
> this happens on pre vista and vista(or greater).
> 
> In general, changing the IP address should not cause this effect (it's
> something inside the tcp/ip stack, WinPcap works in parallel with it).
> Unless the IP address change causes some changes in some NDIS
> intermediate
> driver (so below WinPcap) and there is some unbinding/binding going
> on.
> 
> Aftet the IP change, do you capture *any* packet with WinPcap?
> 
> Have a nice day
> GV
> 
> --------------------------------------------------
> From: "Thorsten Stoffregen" <thorsten.stoffregen at gmx.de>
> Sent: Thursday, September 23, 2010 10:47 AM
> To: <winpcap-users at winpcap.org>
> Subject: Re: [Winpcap-users] winpcap and ip change
> 
> > Hi David,
> >
> > thanks for your replay.
> > Yes, Profinet depends on TCP/IP but it alsp uses
> > special ethernet frames for real-time
> > communication. That makes it really fast
> > (about 1 millisecond cycle Time).
> >
> > Let say you have a robot-arm.
> > TCP/IP itself is needed for configuration of the robot.
> >
> > But the real action - the movement - happens on low level with
> > ethernet frames only, without an overlying protocol.
> > For this reason I use WinPcap to capture these packages.
> > So far it works like a charm.
> >
> > But now there are ethernet-profinet packages who say:
> > Ok, Adapter with mac Foo has now IP Bar
> > (The concept is similar to DHCP).
> > So I need to reconfigure the Windows IP Stack and keep listening
> > to the Low-Level Packages. And after the IP change I don't
> > get the Low Level Packages with WinPcap. TCP/IP and other services
> > are working well.
> >
> > I found the following solution:
> > Close and reopen the capture device with pcap:
> >
> > pcap_close(pcap_t ...);
> > changeIp(.....);
> > Sleep(5000);
> > pcap_open(pcap_t ...);
> >
> > But now I have to wait several seconds between close and open!
> > Without the Waiting it will not work, wait for 5 seconds
> > and it works. So it's a solution, but waiting for 5 seconds....
> > Seems not a very good solution for me.
> >
> > Is there a way to explicit re-initialise the kernel driver?
> > Or even better, to let him do it by himself ;-)
> >
> >
> >
> > ----- Ursprüngliche Mail -----
> >> Thorsten Stoffregen wrote:
> >>
> >> > Hi,
> >> >
> >> > I am building an application which listen to Level 2
> >> > Realtime Traffic. My problem is, that the overlying
> >> > application has to change the ip address of the interface
> >> > on which I am listening with pcap.
> >> >
> >> > After changing the ip I there are packets missing in the
> >> > capture. Especially pakets with Ethernet.Type = 0x8892
> >> > (Profinet), standard traffic like arp request is still
> >> > visible.
> >>
> >> PROFINET appears to be a TCP/IP protocol:
> >>
> >> http://en.wikipedia.org/wiki/PROFINET
> >>
> >> As such, it likely depends on a valid IP address in order to work
> >> correctly,
> >> yes?
> >>
> >> Since you're changing the IP address of the adapter it's hardly
> >> surprising
> >> that Profinet packets are being lost.
> >>
> >> ARP does not rely on IP. That's why it continues to work,
> >> regardless
> >> of what
> >> the adapter's IP address is.
> >>
> >> Do you have any documentation on Profinet? What its various packet
> >> layouts
> >> looks like?
> >>
> >> --
> >> "Fish" (David B. Trout)
> >> fish at softdevlabs.com
> >>
> >>
> >>
> >>
> >> _______________________________________________
> >> Winpcap-users mailing list
> >> Winpcap-users at winpcap.org
> >> https://www.winpcap.org/mailman/listinfo/winpcap-users
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> >
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users