Alert when a packet been captured.

Home Forums Discussions Support Portal Alert when a packet been captured.

This topic contains 10 replies, has 2 voices, and was last updated by  bakhtiar 8 years, 2 months ago.

Viewing 11 posts - 1 through 11 (of 11 total)
  • Author
    Posts
  • #5283

    bakhtiar
    Participant

    Hi;

    Could anyone knows how to know when a packet been captured by a filter, I want to alert the when a packet been captured by a filter…

    FYI I’m using C#…

    Regards

    #6798

    Vadim Smirnov
    Moderator

    Event set to driver through SetPacketEvent API is signaled immediately on packet send/receive event.

    #6799

    bakhtiar
    Participant

    Thanks, this indicates a packet in general but I want to know when a specific packet caught by one of the filters.

    Kind regards

    #6800

    Vadim Smirnov
    Moderator

    It is possible to add a timestamp to packets if needed.

    #6801

    bakhtiar
    Participant

    How? because when a packet been captured by a filter it can not be read the IM buffer. Is it right?

    Regards

    #6802

    Vadim Smirnov
    Moderator

    Ahh, you mean packets passed without being indicated to user mode. Well, since this packets are supposed to be passed with minimal performance affect they have to no event to trigger.

    #6803

    bakhtiar
    Participant

    Hi;

    For example, there is a filter to drop all HTTP packet, how can I now when the packet came and been captured, I want to alert the user that those packets been captured.

    Regards

    #6804

    Vadim Smirnov
    Moderator

    So far only the packets statistics (packets this filter was applied to) is accumulated for loaded filters. There is no special event to indicate that the filter was triggered.

    #6805

    bakhtiar
    Participant

    Hi;

    In Tunnelling mode, Is it possible to read a packet to IM buffer and if this packet matches a condition then it do not resend it back to adapter or MSTCP (by this way the packet has been dropped).. Is it an efficient way to allow or drop packets.

    Regards

    #6806

    Vadim Smirnov
    Moderator

    Yes it is possible and this is the right way to drop packets.

    #6807

    bakhtiar
    Participant

    Hello;

    This means that packets can be dropped or passed either using static filters or checking against a condition in IM buffer, but for the last approach it has more overhead and less performance, am I right?

    Regards

Viewing 11 posts - 1 through 11 (of 11 total)

You must be logged in to reply to this topic.