Hi! > I was using pthreads for two interfaces, but I am trying to optimize now. I > have 15% memory usage.
So you were capturing traffic on two threads with two distinct pcap handlers? Looks fine to me. What's eating 15% of your RAM, exactly? > I am trying to use select, as it seems the most basic. If I understand correctly, you are replacing your threaded aproach by a singly threaded program using select. Unfortunately, I don't know any way to associate a file descriptor with a pcap handle portably. :-( > Junkie uses threads to do this, so can't really use it. Yes junkie uses one thread per interface. The reason behind this is that I use it to perform a lot of process for every packet so using threads on many interfaces offer as much parallelism as necessary (even when you are interested in only one device you can still scatter its traffic through several handlers by proper filtering). > Can I use pcap_loop when using select, or i have to use recvfrom in loop ? I think you will be forced into recvfrom, which is not as portable as plain libpcap so from my very limited knowledge I would recommend against it. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
