Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-24 3:38 GMT+02:00 Yang Luo : > Hi list, > > In latest 0.04 r6 version, I have used 0x02, 0x00, 0x00, 0x00 for an IPv4 > packet and 0x18, 0x00, 0x00, 0x00 for an IPv6 packet (tell me if you have > better value for IPv6). The driver can return NdisMediumNull now for > loopback interface. Wir

Re: [Wireshark-dev] Npcap 0.04 call for test

On Aug 24, 2015, at 1:19 AM, Pascal Quantin wrote: > any reason for not using NdisMediumLoopback that is defined since Vista > according to > https://msdn.microsoft.com/en-us/library/windows/hardware/ff565910%28v=vs.85%29.aspx > ? Maybe it would make sense to switch to DLT_LOOPBACK You mean

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-24 10:19 GMT+02:00 Pascal Quantin : > 2015-08-24 3:38 GMT+02:00 Yang Luo : > >> Hi list, >> >> In latest 0.04 r6 version, I have used 0x02, 0x00, 0x00, 0x00 for an >> IPv4 packet and 0x18, 0x00, 0x00, 0x00 for an IPv6 packet (tell me if >> you have better value for IPv6). The driver can re

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-24 10:28 GMT+02:00 Guy Harris : > > On Aug 24, 2015, at 1:19 AM, Pascal Quantin > wrote: > > > any reason for not using NdisMediumLoopback that is defined since Vista > according to > https://msdn.microsoft.com/en-us/library/windows/hardware/ff565910%28v=vs.85%29.aspx > ? Maybe it would m

Re: [Wireshark-dev] Npcap 0.04 call for test

On Aug 24, 2015, at 1:32 AM, Pascal Quantin wrote: > 2015-08-24 10:28 GMT+02:00 Guy Harris : > >> Note that, if all packets are IPv4 or IPv6 packets, you could also use >> NdisMediumIP, if that means "received and transmitted packets begin with an >> IP header and have no link-layer header",

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-24 10:29 GMT+02:00 Pascal Quantin : > > > 2015-08-24 10:19 GMT+02:00 Pascal Quantin : > >> 2015-08-24 3:38 GMT+02:00 Yang Luo : >> >>> Hi list, >>> >>> In latest 0.04 r6 version, I have used 0x02, 0x00, 0x00, 0x00 for an >>> IPv4 packet and 0x18, 0x00, 0x00, 0x00 for an IPv6 packet (tell m

Re: [Wireshark-dev] Npcap 0.04 call for test

Hi Pascal, "Medium in use" value corresponds to OID_GEN_MEDIA_IN_USE, not OID_GEN_PHYSICAL_MEDIUM, Just below "Medium in use" text, you can see "Physical medium" line, this one is related to OID_GEN_PHYSICAL_MEDIUM, and it's a "Unspecified" for Npcap Loopback Adapter, which I think is a suitable v

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-24 11:39 GMT+02:00 Yang Luo : > Hi Pascal, > > "Medium in use" value corresponds to OID_GEN_MEDIA_IN_USE, not > OID_GEN_PHYSICAL_MEDIUM, Just below "Medium in use" text, you can see > "Physical medium" line, this one is related to OID_GEN_PHYSICAL_MEDIUM, > and it's a "Unspecified" for Npc

Re: [Wireshark-dev] Npcap 0.04 call for test

Hi Pascal, On Mon, Aug 24, 2015 at 4:19 PM, Pascal Quantin wrote: > > > Hi Yang, > > any reason for not using NdisMediumLoopback that is defined since Vista > according to > https://msdn.microsoft.com/en-us/library/windows/hardware/ff565910%28v=vs.85%29.aspx > ? Maybe it would make sense to swit

Re: [Wireshark-dev] Npcap 0.04 call for test

Hi Pascal, On Mon, Aug 24, 2015 at 5:46 PM, Pascal Quantin wrote: > > >> I personally think data returned by OID_GEN_MEDIA_IN_USE should be >> identical with the one returned by OID_GEN_MEDIA_SUPPORTED for our loopback >> condition based on MSDN explanation, and it's "media" instead of "medium",

Re: [Wireshark-dev] Npcap 0.04 call for test

Le 24 août 2015 12:19 PM, "Yang Luo" a écrit : > > Hi Pascal, > > On Mon, Aug 24, 2015 at 4:19 PM, Pascal Quantin wrote: >> >> >> >> Hi Yang, >> >> any reason for not using NdisMediumLoopback that is defined since Vista according to https://msdn.microsoft.com/en-us/library/windows/hardware/ff5659

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-24 12:30 GMT+02:00 Yang Luo : > Hi Pascal, > > On Mon, Aug 24, 2015 at 5:46 PM, Pascal Quantin > wrote: > >> >> >>> I personally think data returned by OID_GEN_MEDIA_IN_USE should be >>> identical with the one returned by OID_GEN_MEDIA_SUPPORTED for our loopback >>> condition based on MSD

Re: [Wireshark-dev] Npcap 0.04 call for test

Hi Pascal, I think you would like to add the link types that WinPcap defined but NDIS doesn't define, see: https://github.com/wireshark/winpcap/blob/master/Common/Packet32.h from Line: 76. Comments said that these are "Custom linktype: NDIS doesn't provide an equivalent". And it seems that Npcap l

Re: [Wireshark-dev] Npcap 0.04 call for test

2015-08-24 13:18 GMT+02:00 Yang Luo : > Hi Pascal, > > I think you would like to add the link types that WinPcap defined but NDIS > doesn't define, see: > https://github.com/wireshark/winpcap/blob/master/Common/Packet32.h from > Line: 76. Comments said that these are "Custom linktype: NDIS doesn't

Re: [Wireshark-dev] Npcap 0.04 call for test

Hi Guy, I have looked at all occurrences of PCAP_IF_LOOPBACK in Npcap's wpcap.dll code at https://github.com/nmap/npcap/search?utf8=%E2%9C%93&q=PCAP_IF_LOOPBACK, it seems that this property is never effectively used inside wpcap.dll's code. In Wireshark's WinPcap official trunk, it is totally unus

Re: [Wireshark-dev] Npcap 0.04 call for test

On Aug 24, 2015, at 6:08 AM, Yang Luo wrote: > I have looked at all occurrences of PCAP_IF_LOOPBACK in Npcap's wpcap.dll > code at > https://github.com/nmap/npcap/search?utf8=%E2%9C%93&q=PCAP_IF_LOOPBACK, it > seems that this property is never effectively used inside wpcap.dll's code. In fad

Re: [Wireshark-dev] Npcap 0.04 call for test

Hi, Npcap 0.04 r7 is released. 1) One change is that PCAP_IF_LOOPBACK is set for "Npcap Loopback Adapter" in DLT_NULL mode in Npcap 0.04 r7. So if you install Npcap with DLT_NULL mode checked, you can see "Npcap Loopback Adapter" is listed in the last row of Wireshark UI. 2) Another change is th