[Winpcap-users] Windows 10 support for WinPcap

Fri Feb 5 17:28:57 UTC 2016

For all practical purposes it is most important to be notified that the link state has changed.  If that takes some seconds to find out it is certainly better than not finding out at all…

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Sven Kerschbaum
Sent: Friday, February 5, 2016 8:27 AM
To: Jiyang Hu <jiyang_hu at yahoo.com>; winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Windows 10 support for WinPcap

I cannot find any information about the function IoctlNdisQueryGlobalStats(...). Do you have a link? I agree that is not an option to query the media state in a loop. I have a working solution using WMI but the notification is not in real-time. I sometimes experience a delay of a few seconds...
I believe query NDIS for OID_GEN_MEDIA_CONNECT_STATUS is a waste of resource if it is put in a loop. Getting a notification of media state change asynchronously should be better. My 2 cents.

On Friday, February 5, 2016 9:23 AM, Nuno Antonio Dias Ferreira <nuno.ferreira at efacec.com<mailto:nuno.ferreira at efacec.com>> wrote:

Hi Sven,

I have an application where I am using npcap and I also have the need to detect the media status changes. To do that I query NDIS to get that information: https://msdn.microsoft.com/en-us/library/windows/hardware/ff569604(v=vs.85).aspx

Here is an example:
if(IoctlNdisQueryGlobalStats(Iface->IOCTLhandler, OID_GEN_MEDIA_CONNECT_STATUS, &ConnectedState, sizeof(ConnectedState), (PUINT)&ReturnedCount) == ERROR_SUCCESS)
      {
            return ConnectedState == NdisMediaStateConnected;
      }

Hope this information could be helpful.

Melhores Cumprimentos / Best Regards
Nuno Antonio Dias Ferreira
Unidade de Automação de Sistemas de Energia / Power System Automation Unit
Efacec Energia, Máquinas e Equipamentos Elétricos, S.A.
[cid:image001.jpg at 01D15FF7.A36681E0]
Disclaimer

From: winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org> [mailto:winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org>] On Behalf Of ?????V5
Sent: 5 de fevereiro de 2016 04:44
To: winpcap-users at winpcap.org<mailto:winpcap-users at winpcap.org>
Subject: Re: [Winpcap-users] Windows 10 support for WinPcap

On Fri, Feb 5, 2016 at 3:56 AM, Mark Pizzolato - Winpcap-Users <winpcap-users-20040408 at subscriptions.pizzolato.net<mailto:winpcap-users-20040408 at subscriptions.pizzolato.net>> wrote:
The inverted call model might be useful in an abstract way to get notified of a media
state change, however, the question then comes back to how to convey that detail
to the application which is using the libpcap APIs.

Since the only APIs that an application which already has a pcap session opened
is using are: pcap_next_ex, pcap_dispatch, pcap_loop and possibly
pcap_sendpacket

pcap_next_ex, pcap_dispatch and pcap_loop are defined to return -1 on an error.
Is media state change an error?
                Is media offline an error?

I prefer to use the phrases in ncpa.cpl.
If the adapter disconnects (like Wi-Fi), libpcap API should only report time-out (you don't get any new packets).
If the adapter is disabled, libpcap API may report error (or time-out)? I didn't try this. One thing for sure is that you can't get new packets too. This thing should not happen when using Npcap/WinPcap. Because when listing adapters with Npcap/WinPcap, disabled adapters never show up on the list. So Npcap/WinPcap assumes that the adapters it uses is always kept as enabled.

pcap_sendpacket is defined to return -1 if a packet wasn’t successfully sent.
                It would seem that returning -1 when the media is offline makes sense

This makes sense to me.

I don’t know for sure how WinPcap behaves under these conditions, but it
seems that it npcap should reliably report errors under the media offline state.
Is there a reason it can’t?

Npcap actually doesn't report errors any better than WinPcap. There's even a chance that Npcap behaves different on reporting errors with WinPcap. Because Npcap uses NDIS6 and WinPcap uses NDIS5.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20160205/7bc69dd8/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1792 bytes
Desc: image001.jpg
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20160205/7bc69dd8/attachment-0001.jpg>