Guy Harris

Is there a way to get an "incoming vs. outgoing" indication from NDIS?

> For NDIS filter drivers like Npcap, direction is determined by whether the packet is in a "send indication" or a "receive indication." NDIS calls separate callback functions for each...

Distinguishing between received and sent could also be useful in the future; at some point I'd like to have a new capture API, delivering pcapng blocks, which would allow the...

> The new pcapng API stuff @guyharris talks about for determining direction of received packets might be a longer term goal, Yes - [pcapng format](https://pcapng.github.io/pcapng/draft-ietf-opsawg-pcapng.html) includes an option for the...

Note that two key capabilities, as seen on [the "NDIS_TIMESTAMP_CAPABILITY_FLAGS structure" page on Microsoft Learn,](https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddndis/ns-ntddndis-_ndis_timestamp_capability_flags) required for this are the `AllReceiveHw` and `AllTransmitHw` - the point here is to provide...

> Try running the same version of Npcap on a windows virtual machine. I did and it works fine. Therefore, I know the problem is coming from my PC and...

See also #568.

Please file this as a libpcap issue as it applies to all OSes, not just Windows (I have a few Linux goodies that can be done with pcapng, for example)....

> Report statistics directly in the packet stream, including adding new statistics as we like without being concerned about backwards compatibility. Yes - `pcap_stats()` is really feeble. You can't add...

> Avoid clearing the entire packet buffer when a capture configuration change is made, preferring instead to inject a block of appropriately descriptive metadata indicating exactly when the change took...