On Tue, Apr 03, 2007 at 04:57:27PM +0100, roy hills wrote: [...]
> What I find is that select() returns when there is any data received > on the network interface; not just data that will match the pcap > filter. In other words, just because select() returned indicating that > the pcap file descriptor was ready to read does not mean that there is > interesting data. Hhhmmm, yeah, I think this is what I was seeing. > I think this is because the DLPI implementation filters in userspace, > not in the kernel, unlike BPF and Linux. Good point. Hadn't thought about it but this makes a lot of sense, and explains the behavior we're seeing. Cheers, Eloy.- - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
