On Thu, Apr 04, 2002 at 07:07:36PM -0800, Beichuan Zhang wrote: > In my application, I want to catch only one packet quickly. But if I set > timeout to 0 in pcap_open_live(), pcap_loop() never (or before I > pressed ctrl-c) returns. If I set it to -1, pcap_open_live() fails.
The meaning of the timeout field in "pcap_open_live()" is dependent on the OS on which you're running. On BSD a timeout of 0 means "no timeout", i.e. the "read()" from the BPF device won't finish until the buffer fills up with packets - which means it could wait forever. > Is there a way to tell the filtering engine return a packet as soon as > it arrives? There is, but there's no way to do it portably, and you can't necessarily do it using libpcap calls. On Linux, HP-UX, AIX with DLPI, and Irix, that's the way libpcap always works, as there's no buffering. On BSD, you'd have to use "pcap_fileno()" to get the file descriptor for the BPF device, and do a BIOCIMMEDIATE "ioctl" to turn on immediate mode. On SunOS 5.x, a timeout of 0 should, I think, do that. There may be ways of doing it on Digital UNIX, SunOS 3.x, and SunOS 4.x as well. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
