[Winpcap-users] packet filter works only with wireshark running

[Guy Harris]

On Apr 6, 2013, at 10:14 AM, rox <roxaz911 at gmail.com> wrote:

> I encountered very strange issue. My application can capture packets
> only if wireshark is sniffing packets on same interface.

Is it only attempting to capture packets being sent by or to the machine running it, or is it trying to capture "third-party" packets that are being sent on your LAN segment or "virtual" network segment ("virtual" in the sense of "implemented inside VMware and not sent over a physical LAN", not in the sense of "VLAN") between two other machines?

If it's trying to do the latter, then you have to put the adapter into promiscuous mode, and:

> if ((handle = pcap_open_live(d->name, 65535, 0, 1000, errbuf)) == NULL)

...you're not doing that.  Pass 1, not 0, as the "promisc" argument.  Otherwise, your program will work only if the interface happens to be in promiscuous mode for some other reason...

...such as another sniffer, such as Wireshark, having put it into promiscuous mode.