none
Hello,I am using the NM api to Captue and analyze, now, i have some questions about API using to ask,please help me,thanks first. RRS feed

  • Question

  • Hello,I am using the NM api to Captue and analyze, now, i have some questions about API using to ask,please help me,thanks first.

    Question:

    1、like this codes:

    API_CONFIGURATION NmApiConfig;
     NmApiConfig.Size = sizeof(NM_API_CONFIGURATION);
     NmGetApiConfiguration(&NmApiConfig);
     NmApiConfig.CaptureEngineHandleCountLimit = 4;
     NmApiInitialize(&NmApiConfig);

    the max num of captured and parsed frames is? default is 1000;

     

    2、NmLoadNplParser, the first  Parameter of this fuction is a path,Please tell me,what is the type of file, please give a example.

     

    3、iterate fields with displayformat:

    ret = NmGetFieldName(myParsedFrame, j, NmFieldDisplayString, DisplayFormatLength, DisplayFormat);” the return value of this Function is 1168,

    ERROR_NOT_FOUND,but the MNM3.4 can display all most .how can i display it like the software of MNM3.4?

     

    that`s all.thanks very much.

     

    Best wishes to you~~

    Friday, February 1, 2013 1:26 PM

All replies

  • Hi,

    Thanks for looking at the NMAPI, hopefully we can solve your issues for you.  For the first question, are you asking what the Maximum is referring to?  I'm not sure if I entirely follow what part you are asking about.  The handles are the references to frames or other objects within the system, so if you try to parse too many at once without releasing them, you'll hit the limit.

    For the second question, I would recommend using the NmLoadWithNplProfile, you would only need the NmLoadNplParser if you're going to be using your own custom parser code.  Then you'd point it to the path where those npl exist.  Just the folder, not a specific file.

    For the third question, I'm not exactly following what you're trying to do, it'd probably be best to share a bit more of the surrounding code.  The other thing you can do is look at the source for some of our expert analysis tools at nmexperts.codeplex.com.  They may help you to see how the API is used in a working example.

    Please let us know if you have any other questions.

    Thanks,


    Michael Hawker | Program Manager | Network Monitor

    Tuesday, February 5, 2013 11:01 PM
    Moderator
  • Hi Michael_Hawker,

       Thanks very much for your replay. About the first question, your replay is not clear for me, i try to change another queation. the question is, if i try to capture frames during a very very long time,how can i do? do i need set NmApiInitialize, how?  I already the limit is 65535.

      

    Thanks


    Thursday, February 21, 2013 8:05 AM
  • You can capture for a long time and save directly to a file, but you need to make sure to free all the handles you open.  For example, you should be able to use the Capturing and Saving Live Data example.  However if you modify it to parse the frames, then you need to clean up those handles as you use them.

    Are you running into an issue?  If so can you share the a code snippet and describe what you are doing with the API?

    Thanks,

    Paul

    Monday, February 25, 2013 5:12 PM
  • You can capture for a long time and save directly to a file, but you need to make sure to free all the handles you open.  For example, you should be able to use the Capturing and Saving Live Data example.  However if you modify it to parse the frames, then you need to clean up those handles as you use them.

    Are you running into an issue?  If so can you share the a code snippet and describe what you are doing with the API?

    Thanks,

    Paul

    Hi,

      Firstly,Thank you very much for my understanding these APIs. I already s olve myproblem. But, my application scenarios is "Live Capture and Pasre Immediately" and save the parsed result. Can it(The MNM APIs) meet this  scenarios?

      Secondly, I have another Problem,Very Urgent. when My programe Run this Api "NmParseFrame", Sometimes, my programe will crash. like"In 0x77c17000 at the most likely exception: 0xC0000005: the write position 0x299d5000 when an access violation occurs".Why?Please Help me.

    Wednesday, February 27, 2013 3:51 AM
  • Live Capture and Parse Immediately is probably a relative concept.  It will never be "Immediate" so the question is how immediate does it have to be.  And this is a question of how powerful the machine is doing the parsing, how much data you have to parse, and how complex the parsing is.  So there will always be limits and variables that affect how immediate the parsing is.  But given you can filter your data down using driver filtering, and you can optimize what you need to parse, you should be able to keep up with a decent throughput of traffic.  But with out testing, you won't know what the limits are.

    For your second issue, I'm not sure I have enough information to help.  Are you closing all your handles?   Is it possible you are overwriting memory or reusing handles?  Do you have a reproducible problem?

    Paul

    Thursday, March 14, 2013 2:02 PM