Overview

Packet32.h contains the data structures and the definitions used by packet.dll. The file is used both by the Win9x and the WinNTx versions of packet.dll, and can be included by the applications that use the functions of this library

Data Structures
struct	NetType
	Network type structure. More...

struct	bpf_program
	A BPF pseudo-assembly program. More...

struct	bpf_insn
	A single BPF pseudo-instruction. More...

struct	bpf_stat
	Structure that contains a couple of statistics values on the current capture. More...

struct	bpf_hdr
	Packet header. More...

struct	dump_bpf_hdr
	Dump packet header. More...

struct	npf_if_addr
	Addresses of a network adapter. More...

struct	LPADAPTER
	Describes an opened network adapter. More...

struct	LPPACKET
	Structure that contains a group of packets coming from the driver. More...

struct	PPACKET_OID_DATA
	Structure containing an OID request. More...

Variables
UINT	NetType::LinkType
	The MAC of the current network adapter (see function PacketGetNetType() for more information)

ULONGLONG	NetType::LinkSpeed
	The speed of the network in bits per second.

UINT	bpf_program::bf_len
	Indicates the number of instructions of the program, i.e. the number of struct bpf_insn that will follow.

struct bpf_insn *	bpf_program::bf_insns
	A pointer to the first instruction of the program.

USHORT	bpf_insn::code
	Instruction type and addressing mode.

UCHAR	bpf_insn::jt
	Jump if true.

UCHAR	bpf_insn::jf
	Jump if false.

int	bpf_insn::k
	Generic field used for various purposes.

UINT	bpf_stat::bs_recv

UINT	bpf_stat::bs_drop

UINT	bpf_stat::ps_ifdrop
	drops by interface. XXX not yet supported

UINT	bpf_stat::bs_capt

struct timeval	bpf_hdr::bh_tstamp

UINT	bpf_hdr::bh_caplen

UINT	bpf_hdr::bh_datalen
	Original length of packet.

USHORT	bpf_hdr::bh_hdrlen

struct timeval	dump_bpf_hdr::ts
	Time stamp of the packet.

UINT	dump_bpf_hdr::caplen

UINT	dump_bpf_hdr::len
	Length of the original packet (off wire).

struct sockaddr_storage	npf_if_addr::IPAddress
	IP address.

struct sockaddr_storage	npf_if_addr::SubnetMask
	Netmask for that address.

struct sockaddr_storage	npf_if_addr::Broadcast
	Broadcast address.

HANDLE	LPADAPTER::ReadEvent

UINT	LPADAPTER::Flags
	Adapter's flags. Tell if this adapter must be treated in a different way, using the Netmon API or the dagc API.

HANDLE	LPPACKET::hEvent

OVERLAPPED	LPPACKET::OverLapped

PVOID	LPPACKET::Buffer

UINT	LPPACKET::Length
	Length of the buffer.

DWORD	LPPACKET::ulBytesReceived

BOOLEAN	LPPACKET::bIoComplete

ULONG	PPACKET_OID_DATA::Oid

ULONG	PPACKET_OID_DATA::Length
	Length of the data field.

UCHAR	PPACKET_OID_DATA::Data [1]

typedef struct WAN_ADAPTER_INT	WAN_ADAPTER
	Describes an opened wan (dialup, VPN...) network adapter using the NetMon API.

typedef WAN_ADAPTER *	PWAN_ADAPTER
	Describes an opened wan (dialup, VPN...) network adapter using the NetMon API.

#define	PACKET_MODE_CAPT 0x0
	Capture mode.

#define	PACKET_MODE_STAT 0x1
	Statistical mode.

#define	PACKET_MODE_MON 0x2
	Monitoring mode.

#define	PACKET_MODE_DUMP 0x10
	Dump mode.

#define	PACKET_MODE_STAT_DUMP MODE_DUMP \| MODE_STAT
	Statistical dump Mode.

#define	Packet_ALIGNMENT sizeof(int)
	Alignment macro. Defines the alignment size.

#define	Packet_WORDALIGN(x) (((x)+(Packet_ALIGNMENT-1))&~(Packet_ALIGNMENT-1))
	Alignment macro. Rounds up to the next even multiple of Packet_ALIGNMENT.

#define	NdisMediumNull -1
	Custom linktype: NDIS doesn't provide an equivalent.

#define	NdisMediumCHDLC -2
	Custom linktype: NDIS doesn't provide an equivalent.

#define	NdisMediumPPPSerial -3
	Custom linktype: NDIS doesn't provide an equivalent.

#define	NdisMediumBare80211 -4
	Custom linktype: NDIS doesn't provide an equivalent.

#define	NdisMediumRadio80211 -5
	Custom linktype: NDIS doesn't provide an equivalent.

#define	NdisMediumPpi -6
	Custom linktype: NDIS doesn't provide an equivalent.

#define	NPF_DISABLE_LOOPBACK 1
	Drop the packets sent by the NPF driver.

#define	NPF_ENABLE_LOOPBACK 2
	Capture the packets sent by the NPF driver.

#define	DOSNAMEPREFIX TEXT("Packet_")
	Prefix added to the adapters device names to create the WinPcap devices.

#define	ADAPTER_NAME_LENGTH 256 + 12
	Maximum length for the name of an adapter. The value is the same used by the IP Helper API.

#define	ADAPTER_DESC_LENGTH 128
	Maximum length for the description of an adapter. The value is the same used by the IP Helper API.

#define	MAX_MAC_ADDR_LENGTH 8
	Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API.

#define	MAX_NETWORK_ADDRESSES 16
	Maximum length for the link layer address of an adapter. The value is the same used by the IP Helper API.

#define	INFO_FLAG_NDIS_ADAPTER 0
	Flag for ADAPTER_INFO: this is a traditional ndis adapter.

#define	INFO_FLAG_NDISWAN_ADAPTER 1
	Flag for ADAPTER_INFO: this is a NdisWan adapter, and it's managed by WANPACKET.

#define	INFO_FLAG_DAG_CARD 2
	Flag for ADAPTER_INFO: this is a DAG card.

#define	INFO_FLAG_DAG_FILE 6
	Flag for ADAPTER_INFO: this is a DAG file.

#define	INFO_FLAG_DONT_EXPORT 8
	Flag for ADAPTER_INFO: when this flag is set, the adapter will not be listed or openend by winpcap. This allows to prevent exporting broken network adapters, like for example FireWire ones.

#define	INFO_FLAG_AIRPCAP_CARD 16
	Flag for ADAPTER_INFO: this is an airpcap card.

Data Structure Documentation

struct NetType

This structure is used by the PacketGetNetType() function to return information on the current adapter's type and speed.

Data Fields
UINT	LinkType
	The MAC of the current network adapter (see function PacketGetNetType() for more information)

ULONGLONG	LinkSpeed
	The speed of the network in bits per second.

struct bpf_program

The program will be injected in the kernel by the PacketSetBPF() function and applied to every incoming packet.

Data Fields
UINT	bf_len
	Indicates the number of instructions of the program, i.e. the number of struct bpf_insn that will follow.

struct bpf_insn *	bf_insns
	A pointer to the first instruction of the program.

struct bpf_insn

bpf_insn contains a single instruction for the BPF register-machine. It is used to send a filter program to the driver.

Data Fields
USHORT	code
	Instruction type and addressing mode.

UCHAR	jt
	Jump if true.

UCHAR	jf
	Jump if false.

int	k
	Generic field used for various purposes.

struct bpf_stat

It is used by packet.dll to return statistics about a capture session.

Data Fields
UINT	bs_recv

UINT	bs_drop

UINT	ps_ifdrop
	drops by interface. XXX not yet supported

UINT	bs_capt

struct bpf_hdr

This structure defines the header associated with every packet delivered to the application.

Data Fields
struct timeval	bh_tstamp

UINT	bh_caplen

UINT	bh_datalen
	Original length of packet.

USHORT	bh_hdrlen

struct dump_bpf_hdr

This structure defines the header associated with the packets in a buffer to be used with PacketSendPackets(). It is simpler than the bpf_hdr, because it corresponds to the header associated by WinPcap and libpcap to a packet in a dump file. This makes straightforward sending WinPcap dump files to the network.

Data Fields
struct timeval	ts
	Time stamp of the packet.

UINT	caplen

UINT	len
	Length of the original packet (off wire).

struct npf_if_addr

This structure is used by the PacketGetNetInfoEx() function to return the IP addresses associated with an adapter.

Data Fields
struct sockaddr_storage	IPAddress
	IP address.

struct sockaddr_storage	SubnetMask
	Netmask for that address.

struct sockaddr_storage	Broadcast
	Broadcast address.

struct ADAPTER

This structure is the most important for the functioning of packet.dll, but the great part of its fields should be ignored by the user, since the library offers functions that avoid to cope with low-level parameters

Data Fields
HANDLE	ReadEvent

UINT	Flags
	Adapter's flags. Tell if this adapter must be treated in a different way, using the Netmon API or the dagc API.

struct PACKET

This structure defines the header associated with every packet delivered to the application.

Data Fields
HANDLE	hEvent

OVERLAPPED	OverLapped

PVOID	Buffer

UINT	Length
	Length of the buffer.

DWORD	ulBytesReceived

BOOLEAN	bIoComplete

struct _PACKET_OID_DATA

It is used by the PacketRequest() function to send an OID to the interface card driver. It can be used, for example, to retrieve the status of the error counters on the adapter, its MAC address, the list of the multicast groups defined on it, and so on.

Data Fields
ULONG	Oid

ULONG	Length
	Length of the data field.

UCHAR	Data [1]

Variable Documentation

UINT bpf_stat::bs_recv

Number of packets that the driver received from the network adapter from the beginning of the current capture. This value includes the packets lost by the driver.

UINT bpf_stat::bs_drop

number of packets that the driver lost from the beginning of a capture. Basically, a packet is lost when the the buffer of the driver is full. In this situation the packet cannot be stored and the driver rejects it.

UINT bpf_stat::bs_capt

number of packets that pass the filter, find place in the kernel buffer and thus reach the application.

struct timeval bpf_hdr::bh_tstamp

The timestamp associated with the captured packet. It is stored in a TimeVal structure.

UINT bpf_hdr::bh_caplen

Length of captured portion. The captured portion can be different from the original packet, because it is possible (with a proper filter) to instruct the driver to capture only a portion of the packets.

USHORT bpf_hdr::bh_hdrlen

Length of bpf header (this struct plus alignment padding). In some cases, a padding could be added between the end of this structure and the packet data for performance reasons. This filed can be used to retrieve the actual data of the packet.

UINT dump_bpf_hdr::caplen

Length of captured portion. The captured portion can smaller than the the original packet, because it is possible (with a proper filter) to instruct the driver to capture only a portion of the packets.

HANDLE LPADAPTER::ReadEvent

A notification event associated with the read calls on the adapter. It can be passed to standard Win32 functions (like WaitForSingleObject or WaitForMultipleObjects) to wait until the driver's buffer contains some data. It is particularly useful in GUI applications that need to wait concurrently on several events. In Windows NT/2000 the PacketSetMinToCopy() function can be used to define the minimum amount of data in the kernel buffer that will cause the event to be signalled.

HANDLE LPPACKET::hEvent

OVERLAPPED LPPACKET::OverLapped

PVOID LPPACKET::Buffer

Buffer with containing the packets. See the PacketReceivePacket() for details about the organization of the data in this buffer

DWORD LPPACKET::ulBytesReceived

Number of valid bytes present in the buffer, i.e. amount of data received by the last call to PacketReceivePacket()

BOOLEAN LPPACKET::bIoComplete

ULONG PPACKET_OID_DATA::Oid

OID code. See the Microsoft DDK documentation or the file ntddndis.h for a complete list of valid codes.

UCHAR PPACKET_OID_DATA::Data[1]

variable-lenght field that contains the information passed to or received from the adapter.

Overview

Data Structures

Variables

Data Structure Documentation

Data Fields

Data Fields

Data Fields

Data Fields

Data Fields

Data Fields

Data Fields

Data Fields

Data Fields

Data Fields

Variable Documentation