Hey Marco, This may help you if you are not doing it. It seemed to help me on Snow Leopard.
Just after the call to pcap_open_live(), I set this ioctl. You may not need
the pcap_setnonblock() for
your application.
if ((pd = pcap_open_live(device->name, snaplen, !pflag, 100, errbuf)) !=
NULL) {
pcap_setnonblock(pd, 1, errbuf);
#if defined(__APPLE_CC__) || defined(__APPLE__)
int v = 1;
ioctl(pcap_fileno(pd), BIOCIMMEDIATE, &v);
#endif
Carter
On Feb 9, 2010, at 5:15 AM, Marco De Angelis wrote:
> Guy Harris <guy <at> alum.mit.edu> writes:
>
>>> Good question. Do you know how could I verify the buffer
>>> they stay in? Is there
>>> some printout I could add before calling pcap_dispatch to see
>>> what's in the kernel buffer and what in the userland buffer?
>>
>> Yes, but you'd have to add it to libpcap.
>>
>
> I made an interesting test.
> By collecting pcap_stats() after every call to pcap_dispatch and
> printing the pcap_stat values out, I could verify that the packets
> are received.
> E.g. if I filter for ICMP packets, by launching "ping" commands
> I can see "ps_recv" increase rapidly.
>
> Now, I don't know what "received" means (in userland? in kernel
> buffer?), but maybe you do :)
>
> Thanks,
> Marco
>
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
>
smime.p7s
Description: S/MIME cryptographic signature
