-
Hello.
I don't believe that packets can be blocked with pcap or winpcap, but I might be wrong about this. If you ask them or read about winpcap functionality and it *can* block packets, then that is something I would be willing to add to sharppcap in short order.
Sharppcap is more of an interface/helper library. We rely on the functionality of winpcap/pcap and .net and provide a c#...
2009-11-07 22:09:34 UTC in SharpPcap
-
What do the letters A and Z denote?
What happens to duplicate packets?
What if the user wants to inspect the packets in the order they arrived and not just the tcpdata?
You probably want to write some unit tests that use wireshark pcap capture files to validate the code.
Chris.
2009-11-05 19:50:11 UTC in SharpPcap
-
I think you would have to know more about how the msn file transfer protocol worked to know that. You could also use the gnu 'file' utility on the first few bytes of the file, or whatever library that utility uses. It can recognize the format of most any file.
Chris.
2009-11-05 00:42:58 UTC in SharpPcap
-
Ahh I see now.
Can you breakpoint where that exception is thrown in PcapDeviceCaptureLoop.cs, line 73, and look at the threads that are running? I'm wondering if the callback handler is running and being blocked while you are shutting sharppcap down.
Basically that error means that the capture loop didn't shut down gracefully for one reason or another. I'm wondering if we need some os...
2009-11-02 05:51:31 UTC in SharpPcap
-
Well, it helps if you know what is going on in the example, in terms of sharppcap api. I can check the examples but it makes it easier to discuss things in terms of the api.
I checked example 3 and it has a read timeout of 1s so the longest delay between callbacks should be at most 1s on windows.
Looking at example 3 I see that we output the time whenever a packet arrives. Where did you...
2009-11-02 01:03:43 UTC in SharpPcap
-
Http sniffing requires tcp reconstruction.
I've worked on this for a company and the basic jist is that we would identify a http session by looking for http headers. If we found one we hand this off to a tcp stream manager that then identifies all packets on that tcp connection and re-orders them, and then when we have packets in order it passes that to the http stream processor that...
2009-11-01 17:23:32 UTC in SharpPcap
-
Patches, not packets.... bah.
2009-11-01 17:18:31 UTC in SharpPcap
-
Oh and thanks :-) We can always use feedback and packets from users of sharppcap since I'm sure there are tons of api and performance improvements that can be found through usage.
Chris.
2009-11-01 17:18:10 UTC in SharpPcap
-
I'm not sure why your packets would be buffered. Are you specifying a read-timeout when you open the PcapDevice via PcapDevice.Open()? If not you might want to specify a timeout of 0. That way, if few packets are captured, you'll get the packets sooner, without grouping them together. This is my interpretation of how this will work. I presume you are running on Windows using WinPcap as Linux has...
2009-11-01 17:16:53 UTC in SharpPcap
-
Hi Ivan.
I'm not sure what you mean about capture thread being aborted. Can you include the exception you are seeing and a full stack trace from the exception?
Chris.
2009-11-01 17:14:20 UTC in SharpPcap
