--- Gisle Vanem <[EMAIL PROTECTED]> wrote:
> (please don't start a new thread by replying to a
> previous unrelated
> posting. It messes up threaded email clients and the
> web-mail archive).
>
sorry about this. Next time I will be more careful.
> Jinhai Yang said:
>
> > I'm looking at set up proper filter rules for an
> > adapter with two IP addresses. My question is:
> Does
> > winpcap work with adapter with multiple IP
> addresses?
> >
> > I looked at the code, seems to me pcap_lookupnet()
> and
> > pcap_compile() both assume one IP address per
> adapter.
>
> Yes, pcap_lookupnet() returns only the 1st address.
> It says so
> plainly in the comment in inet.c:
> We need only the first IPv4 address, so we must
> scan the array returned
> by PacketGetNetInfo() in order to skip non IPv4
> (i.e. IPv6 addresses).
>
> You can probably circumvent this by calling
> PacketGetNetInfoEx() and
> extract the correct address before calling
> pcap_compile().
>
Not sure how this works. pcap_compile() takes a
netmask as input. So if I have 3 addresses (each with
different netmask) assigned to the NIC, I need to call
pcap_compile() 3 times? Will that screw up/overwrite
some internal structures?
What you suggested would work if I want to see traffic
through one of the addresses, but what I want to see
all the traffic (with some filtering rules, of course)
coming through the NIC (from any address).
> But are you sure Windows doesn't create two devices
> in this case?
> (one for each address. The 2nd being some pseudo
> device one can use
> to route through to the 1st device. I know it does
> that for Terredo/IPv6
> tunneling).
>
I don't think windows created two devices in this
case. If you run "ipconfig /all", it will just show
two IP addresses under the same adapter. I know in
some cases, a virtual adapter will be created under
Windows, but I don't think this is the case.
> PS. What would be the proper description of such a
> box? I thought
> "multihomed" means a box with >1 adapter and 1
> address each. Is
> this a multihomed box too?
>
> --gv
>
According to MS white paper "Microsoft Windows 2000
TCP/IP Implementation Details", multihomed simply
means a box with more than one IP address, that
includes both a) multiple IPs per NIC, and b) multiple
physical NICs per box. Or maybe a combination of both.
Thanks for the reply.
Jinhai
__________________________________
Do you Yahoo!?
Yahoo! Photos: High-quality 4x6 digital prints for 25�
http://photos.yahoo.com/ph/print_splash
==================================================================
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use
mailto: [EMAIL PROTECTED]
==================================================================
