On Sat, Dec 10, 2011 at 3:18 PM, <[email protected]> wrote: > Hi! > > > I was using pthreads for two interfaces, but I am trying to optimize > now. I > > have 15% memory usage. > > So you were capturing traffic on two threads with two distinct pcap > handlers? > yes
> Looks fine to me. What's eating 15% of your RAM, exactly? > I think pthread while keeping the states > > > I am trying to use select, as it seems the most basic. > > If I understand correctly, you are replacing your threaded aproach by a > singly > threaded program using select. Unfortunately, I don't know any way to > associate a file descriptor with a pcap handle portably. :-( > > > Junkie uses threads to do this, so can't really use it. > > Yes junkie uses one thread per interface. The reason behind this is that > I use > it to perform a lot of process for every packet so using threads on many > interfaces offer as much parallelism as necessary (even when you are > interested > in only one device you can still scatter its traffic through several > handlers > by proper filtering). > > > Can I use pcap_loop when using select, or i have to use recvfrom in loop > ? > > I think you will be forced into recvfrom, which is not as portable as plain > libpcap so from my very limited knowledge I would recommend against it. > > - > This is the tcpdump-workers list. > Visit https://cod.sandelman.ca/ to unsubscribe. > - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
