On Feb 9, 2010, at 9:41 AM, Carter Bullard wrote:
> Just after the call to pcap_open_live(), I set this ioctl. You may not need
> the pcap_setnonblock() for
> your application.
>
> if ((pd = pcap_open_live(device->name, snaplen, !pflag, 100, errbuf)) !=
> NULL) {
That's a sub-second timeout, which definitely *won't* work in 64-bit mode on
10.6 and 10.6.1, but should work in 10.6.2 (and in 10.5.x and earlier). On
10.6 and 10.6.1, you'd see the symptoms you described, because the timeout
would be set to, in effect, 0, meaning "no timeout", so the packets won't be
delivered until the "store buffer" fills up with packets. Setting
BIOCIMMEDIATE mode means that packets will not be buffered at all, so they're
delivered as soon as they arrive.
It seems unlikely that, at least in 64-bit mode, the problem would have
*started* with an upgrade from 10.6 or 10.6.1 to 10.6.2; that upgrade fixed a
similar problem with Wireshark. If it's still there with 10.6.2, as you and
Marco note is the case, something else is happening; I'll look into that.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
