Loris Degioanni wrote: > No, because winpcap doesn't offer such a feature. > As far as I know, the only OS exporting an "any" device is Linux.
It ought to be possible to add such a feature to the WinPcap .dll without too much trouble. I do something similar to this in my software, which uses the Packet.DLL interface. I simply open a number of different adapters all at once (usually all that there are on my system) which means several calls to PacketOpenAdapter, keeping the adapters' description structures in an array. I then read packets from different adapters at different times. To truly wait for packets on multiple interfaces, in a completely event-driven manner, it appears that we could use Windows' WaitForMultipleObjects function to wait on the ReadEvent handles for as many interfaces as we wanted to look at simultaneously, and then read it off whichever interface Windows told us it came in on using PacketReadPacket on the indicated adapter to read the data. In my opinion, this sounds like a useful feature to add to libpcap in general, and winpcap specifically. I imagine there could be a tiny performance hit though. What does everybody else think? I can imagine a couple different user interfaces to Windump, for example, each of which would require either a new function in the Winpcap library, or a modification of the semantics of an existing function in a compatible way. Imagine if a user could specify the -i option multiple times on the windump command line: for example "windump -i 1 -i 2 -i 4". Or, a user could use an "any" pseudo-device, like on Linux, to represent wanting to open all the adapters on the system: "windump -i any", via a special case in pcap_open_live. This second method could, if desired, also be added into the list of devices returned from pcap_findalldevs, which would enable any application using pcap_findalldevs to see the composite "device" without modification. The first method, on the other hand, would encourage more flexible user interfaces to be built (such as, but not limited to, my example; allowing the "-i" option multiple times on windump's command line) to take advantage of such a hypothetical winpcap multiple open feature. The performance hit, of course, would be in the single adapter case: inside the winpcap library, having to check a boolean flag to see if the device was a compound device, and handle it in a special way. Or alternatively, if the modifications were made to optimize for the multiple-adapter case, the performance hit of the single adapter case would be the difference between calling WaitForMultipleObjects and current WaitForSingleObject function call that is present in Packet.DLL. I'm not sure this "performance hit" is worth worrying about actually. Any thoughts? Besides the usual comments that since I propose it I should be the one to implement it? (Good luck finding time in my schedule! ;)) --David -----Original Message----- From: Loris Degioanni [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 11, 2002 4:44 AM To: [EMAIL PROTECTED] Subject: Re: [WinPcap-users] Multiple NICs No, because winpcap doesn't offer such a feature. As far as I know, the only OS exporting an "any" device is Linux. Loris ----- Original Message ----- From: "Hai Nguyen" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, December 06, 2002 10:07 PM Subject: Re: [WinPcap-users] Multiple NICs > well, I guess it is possible to do thatbecause I am > able to run multiple Ethereal instances for each > interface. I am wondering now if there is any way to > capture all traffic from all interfaces using one > winpcap instance. > > -Hai > > --- Hai Nguyen <[EMAIL PROTECTED]> wrote: > > Hi, > > > > Is it possible for me to have multiple instances of > > Winpcap running on the same machine with each > > caputuring traffic from a different interface? > > > > Thanks, > > -Hai > > > > > > __________________________________________________ > > Do you Yahoo!? > > Yahoo! Mail Plus - Powerful. Affordable. Sign up > > now. > > http://mailplus.yahoo.com > > > > > > > ================================================================== > > This is the WinPcap users list. It is archived at > > > > > http://www.mail-archive.com/[email protected]/ > > > > To unsubscribe use > > mailto: > > > [EMAIL PROTECTED]?body=unsubscribe > > > ================================================================== > > > __________________________________________________ > Do you Yahoo!? > Yahoo! Mail Plus - Powerful. Affordable. Sign up now. > http://mailplus.yahoo.com > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/[email protected]/ > > To unsubscribe use > mailto: [EMAIL PROTECTED]?body=unsubscribe > ================================================================== > ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[email protected]/ To unsubscribe use mailto: [EMAIL PROTECTED]?body=unsubscribe ================================================================== ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[email protected]/ To unsubscribe use mailto: [EMAIL PROTECTED]?body=unsubscribe ==================================================================
