Share via

FindPreviousFrame

  • Article

The FindPreviousFrame function finds the previous frame in the current capture context that matches the filter.

HFRAME WINAPIFindPreviousFrame(HFRAMEhCurrentFrame,
LPSTRProtocolName,
LPADDRESSDestinationAddress,
LPADDRESSSourceAddress,
LPWORDProtocolOffset,
DWORDOriginalFrameNumber,
DWORDLowestFrame);

Parameters

  • hCurrentFrame
    Handle to the frame.

  • ProtocolName
    Protocol name, such as TCP.

  • DestinationAddress
    Destination address of the frame that is searched for.

  • SourceAddress
    Source address of the frame that is searched for.

  • ProtocolOffset
    Pointer to a WORD that receives the protocol offset.

  • OriginalFrameNumber
    Starting point of the search. By default, this function searches backward 1,000 frames from OriginalFrameNumber starting point. You can change the search-back distance by adding this line to the Nmapi.ini file, which is located in the \Network Monitor directory.

    MAXLOOKBACK=<new lookback distance>

  • LowestFrame
    Lowest frame number in the capture that is searched.

Return Values

If the function is successful, the return value is a handle to the previous frame.

If the function is not successful, the return value is NULL.

Remarks

The capture filter is defined primarily by ProtocolName, which is the only required filter input; you can add DestinationAddress and SourceAddress information to increase the capture speed.

ProtocolOffset is returned to the calling parser, which adds this DWORD to the pointer returned by locking the frame (with ParserTemporaryLockFrame) to get the LPBYTE of the protocol that is being searched for. On return, the HFRAME that passed the filter is given to the parser. If the parser finds that the frame is not the one that is being sought, the parser can hand this HFRAME back to the FindPreviousFrame function to retrieve the next frame. The source and destination addresses, which are not required, can be passed in as NULL. When used, these addresses can be of type ADDRESS_TYPE_IP, and so on, not just MAC types.

Requirements

Client Requires Windows XP, Windows 2000 Professional, or Windows NT Workstation 4.0.
Server Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server 4.0.
Header

Declared in Netmon.h.
Library

Link to Nmapi.lib.
DLL Requires Nmapi.dll.