private void Run() { IntPtr rawFrame; UInt32 ret; int count = 0; if (ERROR_SUCCESS == NetmonAPI.NmOpenCaptureFile(_capfile, out rawFrame)) { UInt32 frameCount = 0; Filtering _nmfilter = new Filtering(_filterString, _Outproperties, _Outfields); myFrameParser = _nmfilter.CreateFrameParser(); ret = NetmonAPI.NmGetFrameCount(rawFrame, out frameCount);//get the count of the frames // Console.WriteLine("framecount:" + frameCount); for (UInt32 framenumber = 0; framenumber < frameCount; framenumber++)//for each frame, apply the filter { // Console.WriteLine("framenumber:" + framenumber); _currentframeNumber = (int)framenumber + 1; IntPtr OneRawframe; ret = NetmonAPI.NmGetFrame(rawFrame, framenumber, out OneRawframe); // if (ret == ERROR_SUCCESS) { IntPtr parsedFrame, insFrame; ret = NetmonAPI.NmParseFrame(myFrameParser, OneRawframe, framenumber, NmFrameParsingOption.None, out parsedFrame, out insFrame); if (ret == ERROR_SUCCESS) { //Console.WriteLine("start to"); bool Passed = false; ret = NetmonAPI.NmEvaluateFilter(parsedFrame, _nmfilter.ulfilterId, out Passed); if (ret == ERROR_SUCCESS && Passed == true) { //construct _getframeUnit.FieldIdDict = _nmfilter.FieldIdDict; _getframeUnit.PropertyIdDict = _nmfilter.PropertyIdDict; _getframeUnit.ParsedFrame = parsedFrame; _getframeUnit.RawFrame = OneRawframe; _getframeUnit.FrameParser = myFrameParser; _getframeUnit.FrameNumber = _currentframeNumber; _getframeUnit.Pids = _pids.ToList(); //Console.WriteLine(_currentframeNumber); _getFrameValue = new GetFrameValue(_getframeUnit, _currentframeNumber); if (_getFrameValue.frameUnit.propertyUnit.tcpPayloadLength > 0) { AllGetFrames.Add(_getFrameValue.frameUnit); count++; } } NetmonAPI.NmCloseHandle(parsedFrame); NetmonAPI.NmCloseHandle(insFrame); } else { Console.WriteLine("error parsing frame:" + ret); } NetmonAPI.NmCloseHandle(OneRawframe);//release the cuurent parsed frame } else { Console.WriteLine("error when get frame:" + ret.ToString()); return; } } } else { Console.WriteLine("open capture file failed!"); } NetmonAPI.NmCloseHandle(rawFrame); //NetmonAPI.NmApiClose(); }