Packet Sniffer SDK DLL Edition

Events :: OnPacketReceive

 Previous Next

Occurs immediately after a packet has been received by the network adapter.

Syntax:

void __stdcall OnPacketReceive(DWORD_PTR Param, DWORD_PTR ThParam, HANDLE hPacket, LPVOID pPacketData, DWORD IncPacketSize);

Parameters:

Param

[in] OnPacketReceive event handler parameter. May be set by the AdpSetOnPacketRecv, QueSetOnPacketRecv functions call.

ThParam

[in] User defined thread parameter (see HNFN_THREADBEGIN).

hPacket

[in] HNPacket object handle.

pPacketData

[in] A pointer to the packet data (see also HNPacket.PacketData [Get]).

IncPacketSize

[in] Packet size (see also HNPacket.IncPacketSize [Get/Set]).

Description:

Packets processing code in the OnPacketReceive event handler must be as fast as possible because if the packets processing performance is low, and the network traffic is high, you run the risk of losing some packets.

Please use statistics to make sure that your application does not lose any packets.

For example, when you use a BPF filter, and if your application is in time to process all packets, then the value returned by AdpGetProcessCount is equal to the AdpGetAcceptCount one.

If you do not use a filter, you should compare AdpGetProcessCount and AdpGetRecvCount returned values. In this way you can check, whether your application is able to process the whole network traffic received by the Packet Sniffer SDK internal driver from the system.

When the network traffic is very high, it would be very appropriate to create a packets processing queue in your application, using a separate thread, and just enqueue the received packets in the OnPacketReceive event handler, and to notify this queue about the receiving of a new packet (see HNQueue).

Also, you should take into account that OnPacketReceive event handler is called in the context of a thread, created by Packet Sniffer SDK library.

We strongly recommend you to do nothing related to the data displaying in this event handler. If the traffic is high, such actions may lead to the hanging of the application and packets loss.

OnPacketReceive event handler example:

//---------------------------------------------------------------------------
// Event handler OnPacketReceive of the HNAdapter object
//---------------------------------------------------------------------------
void __sdtcall OnPacketReceive(DWORD_PTR Param, DWORD_PTR ThParam, HANDLE hPacket, 
      LPVOID pPacketData, DWORD IncPacketSize)
 {
   if (PktGetMediumType(hPacket) != atEthernet) return;
   
   ETHERNET_HEADER *pEth  = (ETHERNET_HEADER *)pPacketData;
   unsigned short EthType = htons(pEth->EthType);
   char* PacketBuffer = (char*)pPacketData;

   ...

   if(EthType == ETHERTYPE_ARP)
    {
      ARP_HEADER *pArp = (ARP_HEADER *)&PacketBuffer[sizeof(ETHERNET_HEADER)];
      MoveMemory(DestMacAddr,pArp->Sndr_Hw_Addr,6);
      SetEvent(RecvArpPacket);
      return;
    }

   ...
 }
//---------------------------------------------------------------------------
// Event handler OnPacketReceive of the HNAdapter object
//---------------------------------------------------------------------------
procedure OnPacketReceive(Param: Pointer; ThParam: Pointer; hPacket, 
  pPacketData: Pointer; IncPacketSize: Cardinal); stdcall;
 var
  pEth:    PETHERNET_HEADER;
  EthType: Word;
  pArp:    PARP_HEADER;
begin
   if (PktGetMediumType(hPacket) <> atEthernet) then Exit;

   pEth  := PETHERNET_HEADER(pPacketData);
   EthType := htons(pEth^.EthType);

   ...

   if(EthType = ETHERTYPE_ARP) then
    begin
      pArp := PARP_HEADER(@PByteArray(pPacketData)^[sizeof(ETHERNET_HEADER)]);
      MoveMemory(@DestMacAddr[0],@pArp^.Sndr_Hw_Addr[0],6);
      SetEvent(RecvArpPacket);
      Exit;
    end;

   ...
end;
See also:HNAdapter, AdpSetOnPacketRecv, QueSetOnPacketRecv, AdpOpenAdapter, AdpGetThreadCount, AdpSetThreadCount, AdpGetProcessCount, AdpGetAcceptCount, AdpGetRecvCount, AdpGetOpenTime, HNPacket