On 12/20/2013 09:13 PM, Robert Edmonds wrote:
Hi,
When using netsniff-ng to capture packets to a pcap file, it seems to
not flush any unprocessed packets remaining in the capture ring to the
output file when it receives SIGINT, e.g.:
# netsniff-ng -M -s -i eth1 -o aoeu.pcap
Running! Hang up with ^C!
0 packets incoming (20 unread on exit)
20 packets passed filter
0 packets failed filter (out of space)
0.0000% packet droprate
6 sec, 589766 usec in total
# ls -l
total 4
-rw-r--r-- 1 root root 24 Dec 20 14:43 aoeu.pcap
# capinfos -c aoeu.pcap
File name: aoeu.pcap
Number of packets: 0
#
I think it would be useful functionality to be able to flush the capture
ring on exit, or maybe periodically (perhaps as an option, at least)
which would match the behavior of other packet capture tools.
I believe the change below periodically flushes the capture ring. Would
this be acceptable for netsniff-ng? If I understand the current code
with its infinite timeout, it allows packets buffered in the capture
ring to potentially remain there indefinitely (e.g., if a traffic
generator attached to the capture interface suddenly goes silent).
Thanks Robert! I suspect there's some quirk in the kernel's TPACKET_V3
implementation, so far I was too busy with other work that I haven't come
around to look into that code part. It would not make sense from a user's
point of view imho that he would need to flush stuff on exit as the kernel
should take care of this, I think we didn't have any issue on TPACKET_V2
so far. I think there's something odd with TPACKET_V3 stats anyway, that's
why we do them on our own.
diff --git a/netsniff-ng.c b/netsniff-ng.c
index c5966b1..c00078c 100644
--- a/netsniff-ng.c
+++ b/netsniff-ng.c
@@ -981,7 +981,7 @@ static void recv_only_or_dump(struct ctx *ctx)
break;
}
- ret = poll(&rx_poll, 1, -1);
+ ret = poll(&rx_poll, 1, 1000);
if (unlikely(ret < 0)) {
if (errno != EINTR)
panic("Poll failed!\n");
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
