> -----Original Message-----
> From: Beattie, David [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, December 12, 2002 04:41
> To: '[EMAIL PROTECTED]'
> Subject: RE: [WinPcap-users] Multiple NICs
>
>
> Loris Degioanni wrote:
> > No, because winpcap doesn't offer such a feature.
> > As far as I know, the only OS exporting an "any" device is Linux.
>
> It ought to be possible to add such a feature to the WinPcap .dll without
> too much trouble. I do something similar to this in my software,
> which uses
> the Packet.DLL interface. I simply open a number of different
> adapters all
> at once (usually all that there are on my system) which means
> several calls
> to PacketOpenAdapter, keeping the adapters' description structures in an
> array. I then read packets from different adapters at different times.
>
> To truly wait for packets on multiple interfaces, in a completely
> event-driven manner, it appears that we could use Windows'
> WaitForMultipleObjects function to wait on the ReadEvent handles
> for as many
> interfaces as we wanted to look at simultaneously, and then read it off
> whichever interface Windows told us it came in on using
> PacketReadPacket on
> the indicated adapter to read the data.
>
> In my opinion, this sounds like a useful feature to add to libpcap in
> general, and winpcap specifically. I imagine there could be a tiny
> performance hit though.
Not sure. You have to make sure that packets are correctly ordered (for
example by checking at their timestamp). This could make the data trasfer
from kernel to user space tricky (if you transfer several packets at the
same time, you have to put them into a temp buffer, then check the
timestamp, then copy them into the user buffer).
Moreover, you cannot make sure that packets are correctly ordered, since the
time in which you assign the timestamp depends on the OS, and there is not
guarantees that a packet received first will be marked first.
> What does everybody else think? I can imagine a
> couple different user interfaces to Windump, for example, each of which
> would require either a new function in the Winpcap library, or a
> modification of the semantics of an existing function in a compatible way.
> Imagine if a user could specify the -i option multiple times on
> the windump
> command line: for example "windump -i 1 -i 2 -i 4". Or, a user
> could use an
> "any" pseudo-device, like on Linux, to represent wanting to open all the
> adapters on the system: "windump -i any", via a special case in
> pcap_open_live. This second method could, if desired, also be added into
> the list of devices returned from pcap_findalldevs, which would enable any
> application using pcap_findalldevs to see the composite "device" without
> modification. The first method, on the other hand, would encourage more
> flexible user interfaces to be built (such as, but not limited to, my
> example; allowing the "-i" option multiple times on windump's
> command line)
> to take advantage of such a hypothetical winpcap multiple open
> feature. The
> performance hit, of course, would be in the single adapter case:
> inside the
> winpcap library, having to check a boolean flag to see if the device was a
> compound device, and handle it in a special way. Or alternatively, if the
> modifications were made to optimize for the multiple-adapter case, the
> performance hit of the single adapter case would be the difference between
> calling WaitForMultipleObjects and current WaitForSingleObject
> function call
> that is present in Packet.DLL. I'm not sure this "performance
> hit" is worth
> worrying about actually.
>
> Any thoughts? Besides the usual comments that since I propose it I should
> be the one to implement it? (Good luck finding time in my schedule! ;))
Excellent suggeston.
So, are you willing to make a try?
fulvio
> --David
>
> -----Original Message-----
> From: Loris Degioanni [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, December 11, 2002 4:44 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [WinPcap-users] Multiple NICs
>
>
> No, because winpcap doesn't offer such a feature.
> As far as I know, the only OS exporting an "any" device is Linux.
>
> Loris
>
> ----- Original Message -----
> From: "Hai Nguyen" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, December 06, 2002 10:07 PM
> Subject: Re: [WinPcap-users] Multiple NICs
>
>
> > well, I guess it is possible to do thatbecause I am
> > able to run multiple Ethereal instances for each
> > interface. I am wondering now if there is any way to
> > capture all traffic from all interfaces using one
> > winpcap instance.
> >
> > -Hai
> >
> > --- Hai Nguyen <[EMAIL PROTECTED]> wrote:
> > > Hi,
> > >
> > > Is it possible for me to have multiple instances of
> > > Winpcap running on the same machine with each
> > > caputuring traffic from a different interface?
> > >
> > > Thanks,
> > > -Hai
> > >
> > >
> > > __________________________________________________
> > > Do you Yahoo!?
> > > Yahoo! Mail Plus - Powerful. Affordable. Sign up
> > > now.
> > > http://mailplus.yahoo.com
> > >
> > >
> > >
> > ==================================================================
> > > This is the WinPcap users list. It is archived at
> > >
> > >
> > http://www.mail-archive.com/[email protected]/
> > >
> > > To unsubscribe use
> > > mailto:
> > >
> > [EMAIL PROTECTED]?body=unsubscribe
> > >
> > ==================================================================
> >
> >
> > __________________________________________________
> > Do you Yahoo!?
> > Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> > http://mailplus.yahoo.com
> >
> >
> > ==================================================================
> > This is the WinPcap users list. It is archived at
> > http://www.mail-archive.com/[email protected]/
> >
> > To unsubscribe use
> > mailto: [EMAIL PROTECTED]?body=unsubscribe
> > ==================================================================
> >
>
>
>
> ==================================================================
> This is the WinPcap users list. It is archived at
> http://www.mail-archive.com/[email protected]/
>
> To unsubscribe use
> mailto: [EMAIL PROTECTED]?body=unsubscribe
> ==================================================================
>
>
> ==================================================================
> This is the WinPcap users list. It is archived at
> http://www.mail-archive.com/[email protected]/
>
> To unsubscribe use
> mailto: [EMAIL PROTECTED]?body=unsubscribe
> ==================================================================
>
==================================================================
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/[email protected]/
To unsubscribe use
mailto: [EMAIL PROTECTED]?body=unsubscribe
==================================================================
