I suppose the filtering is performed in kernel mode... Not absolutely
sure because I didn't find any information about this point. I can try
to benchmark those two drivers with many filters to compare
performances.
OK, one can propose to add the pcap driver while installing Ethereal but
it still won't be possible to monitor dialup connections... I use a
modified release of Ethereal for about 2 years (just 2 more lines in the
capture_wpcap.c file) so that I call the network monitor driver if my
dll is found. It works fine and there's no dialup limitation. If we
could propose this feature in standard, Windows Ethereal users would be
certainly more satisfied... What about a check box in the capture option
to enable/disable NM if it is present on the user's computer?
Regards
Laurent
-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx]
Sent: Friday, June 20, 2003 9:22 PM
To: RABRET Laurent FTRD/DAC/ISS
Cc: ethereal-dev@xxxxxxxxxxxx
Subject: Re: [Ethereal-dev] about ethereal
On Friday, June 20, 2003, at 2:02AM, RABRET Laurent FTRD/DAC/ISS wrote:
> I do agree, it's not purely Ethereal specific but it would be so cool
> to
> have a "plug and play" Ethereal distribution for Windows able to
> capture
> traffic stemming from LAN AND dialup networks (the NM driver is
> automatically distributed with Windows on 2000 & XP).
Does the libpcap-for-NM-driver implementation do packet filtering in
user mode or in a kernel driver? If it's in user mode, the LAN capture
might be best done with WinPcap, as its driver does packet filtering
(so packets that would have been discarded in user mode don't even get
copied up to userland).
> If the NM<->pcap
> adaptor is part of libpcap we can forget the "plug & play" feature...
Not if we arrange to install that version of libpcap as well.
If the NM<->pcap adaptor *isn't* part of libpcap, you would have to
build *other* tools that use libpcap (e.g., Snort) specially (which
would require a "developer's pack" for the NM<->pcap adaptor, rather
than having the header files be part of Ethereal).
