[Winpcap-users] Opening 2 listen

[Helmut Vaupotitsch]

Hi,

This is possible if you use separate threads.
Be sure that you leave your capture callback routine as soon as 
possible, otherwise you will loose packets. (consider to use queues)
Use Pcap_stats_ex (with a capture driver handle) to detect packet drops.

On a given *single* adapter, i use pcap_open_live twice(for capturing) 
and pcap_open twice(with to_ms=1000 and pcap_setmode for statistics 
mode). The NPF filters can be set and altered at any time without 
influencing the others.

Regards
Helmut

Emre Eris,gen schrieb:
>
> I want to explain my question a little bit more.
>
>  
>
> Is it doable to listen a device with 2 different filters and capture 
> packets? For example i start listening a device with a filter and 
> dumping the packets to a pcap file, after 15min can i start another 
> listen on the same device with different filter and dump the packets 
> to another pcap file without stopping the old one?
>
>  
>
> Does pcap_open or pcap_next_ex block the incoming packets? What i mean 
> if a packet arrives while listening from two different threads one of 
> them will get the packet and control it for filter can the other 
> thread access the packet?
>
>  
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110719/6cbe2f08/attachment.html>