[Winpcap-users] Windows 10 support for WinPcap

Fri Feb 5 18:00:04 UTC 2016

Hi,

I think this api provides the callback. It's called network list manager:
https://msdn.microsoft.com/en-us/library/ee264321(v=vs.85).aspx
I don't how much you care latency, If you want Npcap to tell you the status
change, it should be slower than the above way. Because driver has no way
to call a user mode app, except the above mentioned invoke thing, but it
sounds complicated.. So you have to get notified by calling pcap next
function or by ioctl periodically. But they are not real time.

Btw, I didn't do the experiment, but could anyone tell me how Npcap
actually behaves as network state changes? Is there obviously wrong
reaction there?

Cheers,
Yang

On Saturday, February 6, 2016, Sven Kerschbaum <svkers at gmail.com> wrote:

> I cannot find any information about the function
> IoctlNdisQueryGlobalStats(...). Do you have a link? I agree that is not an
> option to query the media state in a loop. I have a working solution using
> WMI but the notification is not in real-time. I sometimes experience a
> delay of a few seconds...
> I believe query NDIS for OID_GEN_MEDIA_CONNECT_STATUS is a waste of
> resource if it is put in a loop. Getting a notification of media state
> change asynchronously should be better. My 2 cents.
>
>
> On Friday, February 5, 2016 9:23 AM, Nuno Antonio Dias Ferreira <
> nuno.ferreira at efacec.com
> <javascript:_e(%7B%7D,'cvml','nuno.ferreira at efacec.com');>> wrote:
>
>
> Hi Sven,
>
> I have an application where I am using npcap and I also have the need to
> detect the media status changes. To do that I query NDIS to get that
> information:
> https://msdn.microsoft.com/en-us/library/windows/hardware/ff569604(v=vs.85).aspx
>
> Here is an example:
> if(IoctlNdisQueryGlobalStats(Iface->IOCTLhandler,
> OID_GEN_MEDIA_CONNECT_STATUS, &ConnectedState, sizeof(ConnectedState),
> (PUINT)&ReturnedCount) == ERROR_SUCCESS)
>       {
>             return ConnectedState == NdisMediaStateConnected;
>       }
>
> Hope this information could be helpful.
>
>
> Melhores Cumprimentos / Best Regards
> Nuno Antonio Dias Ferreira
> Unidade de Automação de Sistemas de Energia / Power System Automation Unit
> Efacec Energia, Máquinas e Equipamentos Elétricos, S.A.
> [image: EFA Logo]
> Disclaimer
>
> *From:* winpcap-users-bounces at winpcap.org
> <javascript:_e(%7B%7D,'cvml','winpcap-users-bounces at winpcap.org');>
> [mailto:winpcap-users-bounces at winpcap.org
> <javascript:_e(%7B%7D,'cvml','winpcap-users-bounces at winpcap.org');>] *On
> Behalf Of *?????V5
> *Sent:* 5 de fevereiro de 2016 04:44
> *To:* winpcap-users at winpcap.org
> <javascript:_e(%7B%7D,'cvml','winpcap-users at winpcap.org');>
> *Subject:* Re: [Winpcap-users] Windows 10 support for WinPcap
>
>
>
> On Fri, Feb 5, 2016 at 3:56 AM, Mark Pizzolato - Winpcap-Users <
> winpcap-users-20040408 at subscriptions.pizzolato.net> wrote:
>
> The inverted call model might be useful in an abstract way to get notified
> of a media
> state change, however, the question then comes back to how to convey that
> detail
> to the application which is using the libpcap APIs.
>
> Since the only APIs that an application which already has a pcap session
> opened
> is using are: pcap_next_ex, pcap_dispatch, pcap_loop and possibly
> pcap_sendpacket
>
> pcap_next_ex, pcap_dispatch and pcap_loop are defined to return -1 on an
> error.
> Is media state change an error?
>                 Is media offline an error?
>
>
> I prefer to use the phrases in ncpa.cpl.
> If the adapter disconnects (like Wi-Fi), libpcap API should only report
> time-out (you don't get any new packets).
> If the adapter is disabled, libpcap API may report error (or time-out)? I
> didn't try this. One thing for sure is that you can't get new packets too.
> This thing should not happen when using Npcap/WinPcap. Because when listing
> adapters with Npcap/WinPcap, disabled adapters never show up on the list.
> So Npcap/WinPcap assumes that the adapters it uses is always kept as
> enabled.
>
>
>
> pcap_sendpacket is defined to return -1 if a packet wasn’t successfully
> sent.
>                 It would seem that returning -1 when the media is offline
> makes sense
>
>
> This makes sense to me.
>
>
>
> I don’t know for sure how WinPcap behaves under these conditions, but it
> seems that it npcap should reliably report errors under the media offline
> state.
> Is there a reason it can’t?
>
>
> Npcap actually doesn't report errors any better than WinPcap. There's even
> a chance that Npcap behaves different on reporting errors with WinPcap.
> Because Npcap uses NDIS6 and WinPcap uses NDIS5.
>
>
>
> *From:* winpcap-users-bounces at winpcap.org [mailto:
> winpcap-users-bounces at winpcap.org] *On Behalf Of *Jiyang Hu
> *Sent:* Thursday, February 4, 2016 11:18 AM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] Windows 10 support for WinPcap
>
> @Sven: you need something called - Inverted Call Model
>
> The Inverted Call Model in KMDF - OSR
>
>
> [image: Image removed by sender. image]
>
>
>
>
>
> The Inverted Call Model in KMDF - OSR
> One of the most common questions we see from students, clients, and new
> Windows driver Read more
> View on *www.osr.com*
> Preview by Yahoo
>
>
>
> On Thursday, February 4, 2016 12:49 PM, Sven Kerschbaum <svkers at gmail.com>
> wrote:
>
> @Yang: It is not possible to get notifications of media state changes by
> the API which you proposed in your previous post. It provides only
> notifications about IP table changes.
> Am 04.02.2016 16:31 schrieb "Sven Kerschbaum" <svkers at gmail.com>:
>
> Hi Yang,
>
> thanks for providing me the detailed information about Npcap. I will
> definitively have a look at it and try it.
>
> Cheers,
> SK
>
>
> 2016-02-04 13:04 GMT+01:00 食肉大灰兔V5 <hsluoyz at gmail.com>:
>
> Hi Sven,
>
> Npcap (https://github.com/nmap/npcap) has better performance because of
> NDIS 6. It also has several new features:
>
>
> I actually didn't add a function about making user software getting
> notified about media state changes. From my knowledge I don't know there's
> any support of such a function in libpcap. libpcap is an interface standard
> followed by WinPcap/Npcap. However, I think you can do it using native
> Windows APIs (like Receiving Notification of Network Events in
> https://msdn.microsoft.com/en-us/library/windows/desktop/aa366334(v=vs.85).aspx).
> And if you have any improvement advice about Npcap, I will consider it:)
>
>
> Cheers,
> Yang
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> <javascript:_e(%7B%7D,'cvml','Winpcap-users at winpcap.org');>
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20160206/ed1dd49a/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 1792 bytes
Desc: not available
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20160206/ed1dd49a/attachment-0002.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 662 bytes
Desc: not available
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20160206/ed1dd49a/attachment-0003.jpg>