Hi,
When using netsniff-ng to capture packets to a pcap file, it seems to
not flush any unprocessed packets remaining in the capture ring to the
output file when it receives SIGINT, e.g.:
# netsniff-ng -M -s -i eth1 -o aoeu.pcap
Running! Hang up with ^C!
0 packets incoming (20 unread on exit)
20 packets passed filter
0 packets failed filter (out of space)
0.0000% packet droprate
6 sec, 589766 usec in total
# ls -l
total 4
-rw-r--r-- 1 root root 24 Dec 20 14:43 aoeu.pcap
# capinfos -c aoeu.pcap
File name: aoeu.pcap
Number of packets: 0
#
I think it would be useful functionality to be able to flush the capture
ring on exit, or maybe periodically (perhaps as an option, at least)
which would match the behavior of other packet capture tools.
I believe the change below periodically flushes the capture ring. Would
this be acceptable for netsniff-ng? If I understand the current code
with its infinite timeout, it allows packets buffered in the capture
ring to potentially remain there indefinitely (e.g., if a traffic
generator attached to the capture interface suddenly goes silent).
diff --git a/netsniff-ng.c b/netsniff-ng.c
index c5966b1..c00078c 100644
--- a/netsniff-ng.c
+++ b/netsniff-ng.c
@@ -981,7 +981,7 @@ static void recv_only_or_dump(struct ctx *ctx)
break;
}
- ret = poll(&rx_poll, 1, -1);
+ ret = poll(&rx_poll, 1, 1000);
if (unlikely(ret < 0)) {
if (errno != EINTR)
panic("Poll failed!\n");
--
Robert Edmonds
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
