> So if I understand correctly, on linux( 2.2.18) I cant > be guaranteed to return from pcap_dispatch > periodically.
Correct. > And the only way of returning after > every so many seconds ( approx.) is to adjust the > capture buffer size according to an expected rate and > size of arriving packets ? If by "returning after so many seconds" you mean "not returning until the buffer fills or after so many seconds have elapsed", there *IS* no way to do that on Linux. On some OSes, the underlying packet capture mechanism has a notion of a timeout, wherein it tries to batch up packets and supply multiple packets in one "read()"/"getmsg()"/"recvfrom()"/"ReadFile()"/whatever, and the timeout just keeps it from waiting forever (although whether the timeout expires if *no* packets have arrived is platform-dependent; it does so on BSD, but it doesn't do so on Solaris, for example). Linux just doesn't happen to be one of those OSes. There isn't a capture buffer size to adjust; packets get delivered, one at a time, as soon as they arrive, no matter how fast they're coming in. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
