So, I can do select + pcap_dispatch to read on two interfaces without even using threads.
I read select is slow for monitoring. But with only two interfaces, it should not be a problem. Abhinav On Sat, Dec 10, 2011 at 3:50 PM, Guy Harris <[email protected]> wrote: > > On Dec 10, 2011, at 7:39 AM, abhinav narain wrote: > > > Can I use pcap_loop when using select, > > No. > > You can, however, use pcap_dispatch(). pcap_loop() loops either > indefinitely or until it sees the specified number of packets; it will try > to read more packets from the underlying descriptor, and thus potentially > block. pcap_dispatch() will read more packets from the descriptor at most > once, so it's more appropriate to call if select() or poll() reports the > selectable descriptor for a pcap_t as having packets available. Pass it a > "cnt" argument of -1, so it processes all the packets in the batch that it > reads, and thus does a read at the beginning of each call.- > This is the tcpdump-workers list. > Visit https://cod.sandelman.ca/ to unsubscribe. > - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
