[Winpcap-users] Send packets while capturing

[Mark Pizzolato - WinPCap-Users]

On Tuesday, February 28, 2012 at 2:15 AM, holger wrote:
> I am using Winpcap for an application, that needs to listen to the network
> traffic continuously. While listening, some packets need to be sent on a
> certain event with minimized delay.
> 
> Currently I am using the followin approach:
> 
> 1. pcap_open_live (blocking=true, timeout=0) 2. pcap_dipatch(cnt=-1)
> 
> on event:
> 3. pcap_breakloop (from separate thread) 4. pcap_sendpacket (from original
> thread) 5. goto 2
>
> Unfortunately, pcap_breakloop seems not to break the loop promptly. At
> least in my test implementation on Windows XP (SP3, 32bit) I see a random
> delay (5-15 sec) between pcap_breakloop and the return of pcap_dispatch
> (return value is -2 as exepcted).
> 
> Any kind of timeout-controlled operation is not really desirable for my kind of
> application, as this would introduce some systematic delays. Do you see any
> strictly event-based alternative to sketched approach? What about calling
> pcap_sendpacket in a separate thread during a running pcap_dispatch? But I
> have a bad feeling about this idea...

Go ahead and disregard your 'bad feeling' and call pcap_sendpacket whenever you need to from whatever thread you need to....  It will work just fine (until you call pcap_close that is...).

Independent of your use of pcap_breakloop, you should be aware, that the reading side of your application will see the packets you send with pcap_sendpacket if they aren't restricted from reception with a filter you may setup (using pcap_setfilter) on the pcap_t returned by pcap_open_live.

- Mark Pizzolato