Alert when a packet been captured.

Home › Forums › Discussions › Support › Alert when a packet been captured.

Viewing 11 posts - 1 through 11 (of 11 total)
  • Author
    Posts
  • April 21, 2009 at 6:51 pm #5283
    bakhtiar
    Participant

      Hi;

      Could anyone knows how to know when a packet been captured by a filter, I want to alert the when a packet been captured by a filter…

      FYI I’m using C#…

      Regards

      April 22, 2009 at 7:18 pm #6798
      Vadim Smirnov
      Keymaster

        Event set to driver through SetPacketEvent API is signaled immediately on packet send/receive event.

        April 22, 2009 at 8:15 pm #6799
        bakhtiar
        Participant

          Thanks, this indicates a packet in general but I want to know when a specific packet caught by one of the filters.

          Kind regards

          April 23, 2009 at 8:47 am #6800
          Vadim Smirnov
          Keymaster

            It is possible to add a timestamp to packets if needed.

            April 23, 2009 at 6:40 pm #6801
            bakhtiar
            Participant

              How? because when a packet been captured by a filter it can not be read the IM buffer. Is it right?

              Regards

              April 27, 2009 at 4:13 pm #6802
              Vadim Smirnov
              Keymaster

                Ahh, you mean packets passed without being indicated to user mode. Well, since this packets are supposed to be passed with minimal performance affect they have to no event to trigger.

                April 28, 2009 at 7:48 pm #6803
                bakhtiar
                Participant

                  Hi;

                  For example, there is a filter to drop all HTTP packet, how can I now when the packet came and been captured, I want to alert the user that those packets been captured.

                  Regards

                  April 29, 2009 at 8:43 am #6804
                  Vadim Smirnov
                  Keymaster

                    So far only the packets statistics (packets this filter was applied to) is accumulated for loaded filters. There is no special event to indicate that the filter was triggered.

                    April 29, 2009 at 9:06 am #6805
                    bakhtiar
                    Participant

                      Hi;

                      In Tunnelling mode, Is it possible to read a packet to IM buffer and if this packet matches a condition then it do not resend it back to adapter or MSTCP (by this way the packet has been dropped).. Is it an efficient way to allow or drop packets.

                      Regards

                      April 29, 2009 at 4:44 pm #6806
                      Vadim Smirnov
                      Keymaster

                        Yes it is possible and this is the right way to drop packets.

                        April 29, 2009 at 8:07 pm #6807
                        bakhtiar
                        Participant

                          Hello;

                          This means that packets can be dropped or passed either using static filters or checking against a condition in IM buffer, but for the last approach it has more overhead and less performance, am I right?

                          Regards

                        • Author
                          Posts
                        Viewing 11 posts - 1 through 11 (of 11 total)
                        • You must be logged in to reply to this topic.