Wireshark · Wireshark-dev: Re: [Wireshark-dev] Npcap 0.04 call for test

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

2015-08-24 10:29 GMT+02:00 Pascal Quantin <pascal.quantin@xxxxxxxxx>:

2015-08-24 10:19 GMT+02:00 Pascal Quantin <pascal.quantin@xxxxxxxxx>:

2015-08-24 3:38 GMT+02:00 Yang Luo <hsluoyb@xxxxxxxxx>:

Hi list,

In latest 0.04 r6 version, I have used 0x02, 0x00, 0x00, 0x00 for an IPv4 packet and 0x18, 0x00, 0x00, 0x00 for an IPv6 packet (tell me if you have better value for IPv6). The driver can return NdisMediumNull now for loopback interface. Wireshark seems to work now, one little issue is that in the "Characteristics" tab in loopback interface's "Interface Details", "Media supported" and "Medium in use" shows (0xffffffff) instead of a understandable string, this is because that the source code lacks the -1 to string mapping.

Latest installer is at:

https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.04-r6.exe

Cheers,

Yang

Hi Yang,

any reason for not using NdisMediumLoopback that is defined since Vista according to https://msdn.microsoft.com/en-us/library/windows/hardware/ff565910%28v=vs.85%29.aspx ? Maybe it would make sense to switch to DLT_LOOPBACK in that case (in that case the packet type must be put in network order).

Note that Wireshark would still display the raw value: I'm gonna update the array.

Any reason for not making the NULL/loopback mode default instead of the fake ethernet header?

Cheers,

Pascal.

BTW for the "Medium in use" value (that corresponds to OID_GEN_PHYSICAL_MEDIUM) should not you report NdisPhysicalMediumUnspecified instead of -1?

Please discard this last email: I mixed "medium in use" with "physical medium" which is properly reported as unspecified.