On Nov 17, 2008, at 1:46 PM, Giovanni Venturi wrote:
To make the pcap_next/pcap_ex non blocking under Linux I use:
FD_ZERO(&m_fdset);
FD_SET(m_pcap_fd, &m_fdset);
m_fdtimeout.tv_sec = 0;
m_fdtimeout.tv_usec = CAP_READ_TIMEOUT*1000;
selRet = select(m_pcap_fd+1, &m_fdset, NULL, NULL, &m_fdtimeout);
How is that "non-blocking"? That select() call blocks until either
m_pcap_fd is readable or the timeout expires.
No possibility to delete this ugly code with libpcap 1.0.0?
I've seen:
int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);
Doesn't work under Linux?
It worked when I tested it; what do you mean by "doesn't work"?
(Be aware that the timeout argument to pcap_open_live() has *never*
been guaranteed to ensure that pcap_next()/pcap_next_ex() will return
within the timeout period. It only guarantees that, *if* at least one
packet has been captured, the application will never wait longer than
the timeout period to see that packet; it might wait less, but that's
not guaranteed.
This wasn't originally documented, but, for a while now, has been
explicitly documented in the pcap(3) man page:
pcap_open_live() is used to obtain a packet capture
descriptor to look
at packets on the network. device is a string that specifies
the net-
work device to open; on Linux systems with 2.2 or later
kernels, a
device argument of "any" or NULL can be used to capture
packets from
all interfaces. snaplen specifies the maximum number of
bytes to cap-
ture. If this value is less than the size of a packet that
is cap-
tured, only the first snaplen bytes of that packet will be
captured and
provided as packet data. A value of 65535 should be
sufficient, on
most if not all networks, to capture all the data available
from the
packet. promisc specifies if the interface is to be put into
promiscu-
ous mode. (Note that even if this parameter is false, the
interface
could well be in promiscuous mode for some other reason.)
For now,
this doesn't work on the "any" device; if an argument of
"any" or NULL
is supplied, the promisc flag is ignored. to_ms specifies
the read
timeout in milliseconds. The read timeout is used to arrange
that the
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
read not necessarily return immediately when a packet is seen,
but that
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
it wait for some amount of time to allow more packets to
arrive and to
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
read multiple packets from the OS kernel in one operation.
Not all
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
platforms support a read timeout; on platforms that don't,
the read
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
timeout is ignored. A zero value for to_ms, on platforms
that support
^^^^^^^^^^^^^^^^^^
a read timeout, will cause a read to wait forever to allow
enough pack-
ets to arrive, with no timeout. errbuf is used to return
error or
warning text. It will be set to error text when
pcap_open_live() fails
and returns NULL. errbuf may also be set to warning
text when
pcap_open_live() succeds; to detect this case the caller
should store a
zero-length string in errbuf before calling pcap_open_live()
and dis-
play the warning to the user if errbuf is no longer a
zero-length
string.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
