Share via

CAPTUREFILTER

  • Article

The CAPTUREFILTER structure contains capture filter data.

typedef struct _CAPTUREFILTER {
  DWORD FilterFlags;
  LPBYTE lpSapTable;
  LPWORD lpEtypeTable;
  WORD nSaps;
  WORD nEtypes;
  LPADDRESSTABLE AddressTable;
  EXPRESSION FilterExpression;
  TRIGGER Trigger;
  DWORD nFrameBytesToCopy;
  RESERVED Reserved;
} CAPTUREFILTER, 
 *LPCAPTUREFILTER;

Members

  • FilterFlags
    Flags that describe the contents of the capture filter.

    Value Meaning
    CAPTUREFILTER_FLAGS_INCLUDE_ALL_SAPS
    0x0001    		 Includes all SAPs as acceptable frames.
    CAPTUREFILTER_FLAGS_INCLUDE_ALL_ETYPES
    0x0002    		 Include all Etypes as acceptable frames.
    CAPTUREFILTER_FLAGS_LOCAL_ONLY
    0x0008    		 No P-mode
    CAPTUREFILTER_FLAGS_KEEP_RAW
    0x0020    		 Keep SMT and token ring MAC frames.

  • lpSapTable
    Pointer to an array of SAP values. This member indicates the SAP values that are valid to pass to the driver. If CAPTUREFILTER_FLAGS_INCLUDE_ALL_SAPS is set, this becomes an exception list (include all SAPS except these).

  • lpEtypeTable
    Pointer to an array of Etype values. This indicates those Etype values that are valid to pass to the driver. If CAPTUREFILTER_FLAGS_INCLUDE_ALL_ETYPES is set, this becomes an exception list (include all Etypes except these).

  • nSaps
    Number of SAPs in the SAP table.

  • nEtypes
    Number of Etypes in the Etype table.

  • AddressTable
    Name of the address table.

  • FilterExpression
    An EXPRESSION structure. This contains the pattern match portion of the capture filter.

  • Trigger
    Reserved.

  • nFrameBytesToCopy
    If this member is not 0, then it specifies how many bytes to keep of each frame received. If it is 0, then keep the whole frame.

  • Reserved
    Reserved.

Remarks

The combination of flags, values, and expressions determine which frames will be passed by the driver that uses this structure data. For more information about implementing a CAPTUREFILTER structure, see Capture Filters.

Requirements

Client Requires Windows XP, Windows 2000 Professional, or Windows NT Workstation 4.0.
Server Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server 4.0.
Header

Declared in Netmon.h.

See Also

ADDRESSTABLE, ADDRESSPAIR, EXPRESSION, ANDEXP, PATTERNMATCH