On Dec 10, 2011, at 12:58 PM, abhinav narain wrote:
> So, I can do select + pcap_dispatch to read on two interfaces without even
> using threads.
>
> I read select is slow for monitoring.
Possibly. If you don't care about portability, you could use epoll():
http://kernel.org/doc/man-pages/online/pages/man7/epoll.7.html
> But with only two interfaces, it should not be a problem.
I think at least one of the scalability issues with select() is that the set of
FDs to be monitored is copied on every call; for two FDs that shouldn't be too
bad.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
