On Tue, Oct 13, 2015 at 3:20 PM, Mark Ellzey <[email protected]> wrote:
> > There shouldn't be a difference, technically that is. 1.x differs greatly > though in functionality, but is backwards compat with 1.x. A few years ago > I did a 2.x conversion for some very old code: > https://github.com/ellzey/trafan/blob/master/trafan.c with pcap. > > and *many* many years ago I did this which never moved out to 2.x, > completely 1.0. But it still works with old/new pcap and libevent as seen > here: > > https://strcpy.net/mark/dns_stuff/dns-sla/dnsm.c > https://strcpy.net/mark/dns_stuff/dns_spoof_watch/dns_spoof_watch.c > > > But mind you, pcap_dispatch with -1 means you may be processing a ton of > packets, all of which call your pcap callback. > > All of this was done 9-10 years ago; so no mocking! (though it has been ripped and used for profit by certain individuals today, which I find amusing since it's such horrible code)
