Comments on: pcap-sharp http://www.chrishowie.com/2007/02/27/pcap-sharp/ Trading social skills for technical prowess since 1994 Tue, 06 Jan 2009 11:43:58 +0000 http://wordpress.org/?v=2.7 hourly 1 By: Lucky_JL http://www.chrishowie.com/2007/02/27/pcap-sharp/comment-page-1/#comment-931 Lucky_JL Thu, 05 Jul 2007 20:43:23 +0000 http://www.chrishowie.com/2007/02/27/pcap-sharp/#comment-931 I see your efforts but this is something that already exists, SharpPcap - http://www.tamirgal.com/home/dev.aspx?Item=SharpPcap - http://www.codeproject.com/cs/internet/sharppcap.asp Lucky_JL I see your efforts but this is something that already exists,

SharpPcap
- http://www.tamirgal.com/home/dev.aspx?Item=SharpPcap
- http://www.codeproject.com/cs/internet/sharppcap.asp

Lucky_JL

]]> By: Chris http://www.chrishowie.com/2007/02/27/pcap-sharp/comment-page-1/#comment-580 Chris Tue, 20 Mar 2007 21:38:34 +0000 http://www.chrishowie.com/2007/02/27/pcap-sharp/#comment-580 I've implemented this and committed it (r43). There is a sharp drop in CPU usage and the memory consumption is no longer growing out of control, but seems to be cleaning up after itself with no problems. I had planned to do this eventually, but thanks for the motivation. I simply changed the implementation of PcapHandle.ReadNext() so you should be able to use that method just as you were using it. I’ve implemented this and committed it (r43). There is a sharp drop in CPU usage and the memory consumption is no longer growing out of control, but seems to be cleaning up after itself with no problems.

I had planned to do this eventually, but thanks for the motivation. I simply changed the implementation of PcapHandle.ReadNext() so you should be able to use that method just as you were using it.

]]> By: Chris http://www.chrishowie.com/2007/02/27/pcap-sharp/comment-page-1/#comment-578 Chris Tue, 20 Mar 2007 21:21:22 +0000 http://www.chrishowie.com/2007/02/27/pcap-sharp/#comment-578 Yes, I understand that you can't break the loop from another thread. pcap_breakloop for some reason breaks the loop after the next packet is received. Which makes it useless unless you're on a pretty busy network. The declaration you gave is insufficient unfortunately. This call is not quite as simple. For reference, the C declaration is: int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header, const u_char **pkt_data); The closest we can get is: [DllImport(PcapDll)] internal static extern int pcap_next_ex(IntPtr p, out IntPtr header, out IntPtr buf); Then we'd have to make a few calls to some Marshal methods to extract the data. Sit tight, I may have something in svn by the end of the day. Yes, I understand that you can’t break the loop from another thread. pcap_breakloop for some reason breaks the loop after the next packet is received. Which makes it useless unless you’re on a pretty busy network.

The declaration you gave is insufficient unfortunately. This call is not quite as simple. For reference, the C declaration is:

int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header, const u_char **pkt_data);

The closest we can get is:

[DllImport(PcapDll)]
internal static extern int pcap_next_ex(IntPtr p, out IntPtr header, out IntPtr buf);

Then we’d have to make a few calls to some Marshal methods to extract the data. Sit tight, I may have something in svn by the end of the day.

]]> By: Hubert http://www.chrishowie.com/2007/02/27/pcap-sharp/comment-page-1/#comment-576 Hubert Tue, 20 Mar 2007 14:35:23 +0000 http://www.chrishowie.com/2007/02/27/pcap-sharp/#comment-576 Thanx for the quick response!!!, I am also trying to use pcap_next_ex function call instead of Read, ReadNext, and Dispatch, because of this memory leak. I have a sample code provided by WinPcap 4.0 development downlad in VC++ 6.0 and pcap_next_ex function seems to work pretty well. But in VC# after implementation of pcap_next_ex function, I don't recieve any data, even though I don't get the error that it would tell me that I defined the function wrong. Here is my function call that I am using: int res = PcapCall.pcap_next_ex(this.ptr, ref header, pkt_data); and the definition is: [DllImport(PcapDll)] internal static extern int pcap_next_ex(IntPtr p, ref PocketHeader header, string buf); I am not sure, maybe I am defining it wrong, but the program will not give the error. Also I am using VC# in Visual Studio 2005. If you get bored sometimes, could you look into that function? I am getting eager to resolve this problem. Basically I am trying to interrupt the data collection from ethernet with a click of a button from my application interface. Right now the "ethernet" routine runs in a different thread then the application itself, so I can easly click other buttons or what not while I am collecting the ethernet data, just the interruption of collecting that data gives me a problem. If you want I can send you the ".sln" file with other ".cs" files. Thanx again for the previous response! Thanx for the quick response!!!, I am also trying to use pcap_next_ex function call instead of Read, ReadNext, and Dispatch, because of this memory leak. I have a sample code provided by WinPcap 4.0 development downlad in VC++ 6.0 and pcap_next_ex function seems to work pretty well. But in VC# after implementation of pcap_next_ex function, I don’t recieve any data, even though I don’t get the error that it would tell me that I defined the function wrong. Here is my function call that I am using:
int res = PcapCall.pcap_next_ex(this.ptr, ref header, pkt_data);

and the definition is:
[DllImport(PcapDll)]
internal static extern int pcap_next_ex(IntPtr p, ref PocketHeader header, string buf);

I am not sure, maybe I am defining it wrong, but the program will not give the error. Also I am using VC# in Visual Studio 2005.

If you get bored sometimes, could you look into that function? I am getting eager to resolve this problem. Basically I am trying to interrupt the data collection from ethernet with a click of a button from my application interface. Right now the “ethernet” routine runs in a different thread then the application itself, so I can easly click other buttons or what not while I am collecting the ethernet data, just the interruption of collecting that data gives me a problem. If you want I can send you the “.sln” file with other “.cs” files.
Thanx again for the previous response!

]]> By: Chris http://www.chrishowie.com/2007/02/27/pcap-sharp/comment-page-1/#comment-574 Chris Mon, 19 Mar 2007 19:34:22 +0000 http://www.chrishowie.com/2007/02/27/pcap-sharp/#comment-574 To get a list of devices, call Pcap.FindAllDevices(). This returns an IList containing InterfaceDefinition objects that correspond to all available network interfaces. You can use a while loop. PcapHandle.Dispatch() takes the same arguments as PcapHandle.Loop() but returns generally after one packet has been read. You can also use PcapHandle.ReadNext() to read exactly one packet and return it. Note that both Dispatch and ReadNext (which uses Dispatch) if called many times seem to leak memory. I'm not sure where this is coming from, so keep your eyes on memory usage if you go this route. To get a list of devices, call Pcap.FindAllDevices(). This returns an IList containing InterfaceDefinition objects that correspond to all available network interfaces.

You can use a while loop. PcapHandle.Dispatch() takes the same arguments as PcapHandle.Loop() but returns generally after one packet has been read. You can also use PcapHandle.ReadNext() to read exactly one packet and return it.

Note that both Dispatch and ReadNext (which uses Dispatch) if called many times seem to leak memory. I’m not sure where this is coming from, so keep your eyes on memory usage if you go this route.

]]> By: Hubert http://www.chrishowie.com/2007/02/27/pcap-sharp/comment-page-1/#comment-573 Hubert Mon, 19 Mar 2007 18:15:35 +0000 http://www.chrishowie.com/2007/02/27/pcap-sharp/#comment-573 hi, it is pretty good code and it seem to work. I have 2 questions: 1. Do you know how to get the device name? instead of writing "eth2", I would like to get the device name as a pick from the list. 2. I also would like to use a while loop insted handle.loop routine. Do you know what is the best routine to use from your class structure? and also how do i use it in the main code? If you can, please respond, I appreciate your code. I use multithread technique with my VC#program and your code is working properly. Thanx again for posting it! hi, it is pretty good code and it seem to work. I have 2 questions:
1. Do you know how to get the device name? instead of writing “eth2″, I would like to get the device name as a pick from the list.

2. I also would like to use a while loop insted handle.loop routine. Do you know what is the best routine to use from your class structure? and also how do i use it in the main code?

If you can, please respond, I appreciate your code. I use multithread technique with my VC#program and your code is working properly. Thanx again for posting it!

]]>