PCapDotNet - ReceivePacket(out packet) - NULL packet out, Eof when processing pcap file

Apr 11, 2012 at 11:53 PM


I am having difficulty with a live capture, and capturing from a capture file, at a particular site. In our office, the packets are captured as normal for both live, and capturing from a file, but at this other particular site, we receive NULL for the packet and Eof in the Result of ReceivePacket(out packet). My questions are below:

1) Have you seen this type of behavior before? What was the cause in your particular instance?

2) Is there something in particular in the captured data that is causing this issue at this particular site, VLAN Tagged Packets? Something else ( If you need to review the capture file, I can e-mail it to you or post it if I can find a way to post on the site )

We are using the latest release of PCapDotNet, I can provide the capture file to anyone who requests is (if there was a way to attach here, let me know, I have not found it yet).

Apr 12, 2012 at 8:16 PM



What do you mean by "site"?

Can you maybe upload the .pcap file to some public location so it's possible to look at it?



Apr 12, 2012 at 8:39 PM
Edited Apr 13, 2012 at 1:47 AM

To different locations is what I mean by site. I do have the pcap file. You can download it from http://www.preparedapps.com/test.zip, extract the zip file and it will be test.pcap. This is a very small wireshark capture from the location I am talking about.

Apr 13, 2012 at 1:48 AM

If you have any questions, post them and I will try my best to answer. Thanks for your help. I really do think there is a bug somewhere in PcapDotNet, or maybe something I am doing, but if it is, I am not sure what. Thanks.

Apr 13, 2012 at 8:49 AM

Can you post the code you use on this capture file that causes returns you null Packets?

Apr 14, 2012 at 3:25 AM

After further investigation, we found the problem. The problem was that the traffic was vlan tagged and we had to adjust the filter string to include 'vlan' so that we would be able to capture the vlan tagged packets. I should have known that, it is in the WinPCap documentation. But thank you very much for your help. That was it though, just a simple filter string.