You are correct. If you are using promiscuous mode, you will get all packets, even the packets you send out. The way to deal with this is to throw away those packets you know that are being sent out by your thread.
You could do this at the user level by identifying the packets that the thread just sent out and not resend it. You could parse the packet and look for the NDIS_FLAGS_IS_LOOPBACK_PACKET setting in the packet and ignore these. Perhaps you can set a filter so you don't see those outgoing packets at all. If you know what port you are sending packets out of for each thread, you could set a filter that excludes those packets whose source IP address and port match the one used by the thread. This assumes Ethernet of course. The other thread would use a similar filter string but with a different port. Refer to the BPF man page for information on filter strings. Thank you, "God does not play dice!" -- Albert Einstein "Not only does God play dice with the Universe - he sometimes casts them where they can't be seen." -- Stephen Hawking -----Original Message----- From: Bowers, Rick [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 22, 2005 5:50 PM To: winpcap-users@winpcap.polito.it Subject: RE: [WinPcap-users] PROBLEM WITH BUILDING A BRIDGE Thanks for the suggestion. I see pcap_open_live(), that is called by pcap_open(), calls PacketSetHwFilter() with either NDIS_PACKET_TYPE_PROMISCUOUS or NDIS_PACKET_TYPE_ALL_LOCAL depending on whether it was asked to run in promiscuous mode. From ntddndis.h the only NDIS_PACKET* defines are: // // Ndis Packet Filter Bits (OID_GEN_CURRENT_PACKET_FILTER). // #define NDIS_PACKET_TYPE_DIRECTED 0x00000001 #define NDIS_PACKET_TYPE_MULTICAST 0x00000002 #define NDIS_PACKET_TYPE_ALL_MULTICAST 0x00000004 #define NDIS_PACKET_TYPE_BROADCAST 0x00000008 #define NDIS_PACKET_TYPE_SOURCE_ROUTING 0x00000010 #define NDIS_PACKET_TYPE_PROMISCUOUS 0x00000020 #define NDIS_PACKET_TYPE_SMT 0x00000040 #define NDIS_PACKET_TYPE_ALL_LOCAL 0x00000080 #define NDIS_PACKET_TYPE_GROUP 0x00001000 #define NDIS_PACKET_TYPE_ALL_FUNCTIONAL 0x00002000 #define NDIS_PACKET_TYPE_FUNCTIONAL 0x00004000 #define NDIS_PACKET_TYPE_MAC_FRAME 0x00008000 --> none of which seems to be related to loopback. An interesting discussion at http://www.ndis.com/papers/loopback.htm says that the NDIS_FLAGS_IS_LOOPBACK_PACKET is set on received packets (obviously if it's a loopback packet). However, I don't see where I have access to the flag in WinPcap (especially running on Windows/XP). This same document says packets are always looped back when in promiscuous mode (which is how I am forced to be running). Rick ====================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ To unsubscribe use mailto: [EMAIL PROTECTED] ====================== ================================================================= This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ To unsubscribe use mailto: [EMAIL PROTECTED] =================================================================
