Hi,
I'm working on a program using libpcap. The program keeps modifying
the filter string on-the-fly and calling pcap_compile(). Though the first
couple calls succeed, it always fails at the 8th call to pcap_compile()
with error: "too many registers needed to evaluate expression". Is it a
bug? or anyway to recycle registers? Following is a test program. I've
tried it with libpcap 0.7.1 on RedHat 7.0 and 6.2.
Thanks
---
beichuan
//---cut here---
#include <stdio.h>
#include <pcap.h>
int main(int argc, char *argv[])
{
pcap_t *cap;
char filter[] = "tcp[13] & 2 = 2 and tcp[13] & 16 = 16";
int n;
bpf_u_int32 netmask, localnet;
char pcaperr[PCAP_ERRBUF_SIZE];
struct bpf_program fp;
pcap_lookupnet("eth0", &localnet, &netmask, pcaperr) < 0;
cap = pcap_open_live("eth0", 120, 0, 0, pcaperr);
for(n=0; n<100; n++)
{
printf("%d:\n", n);
if( pcap_compile(cap, &fp, filter, 1, netmask) < 0)
{
pcap_perror(cap, "pcap_compile failed");
return -1;
}
pcap_freecode(&fp);
}
pcap_close(cap);
return 0;
}
//---end of program---
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
