Guy, Thanks for the answer.
My application was actually a small hack to prove or disprove behavior of QoS deployment in the network I am responsible for, and I wanted to hack some little, quick and dirty, perl script, which will sniff packets from the wire, and calculate some basic statistics about their time of arrival. My idea was, to collect those statistics on network management station, running some mrtg-like SNMP data collector. Hence, I wanted to process in my agent asynchroous events: 1. SNMP get requests, and 2. read and process pcap filtered packets. The whole think meant to be small, simple and don't even consider this as a project for itself. So I will rather not use autoconfigure, and stuff like this :-) Anyway -- going back to core issue -- Please correct me if I misunderstood something: There are some idiosyncrasies in different versions/implementations of pcap libraries. But as long as I will follow rules given by you, and I will force pcap handle to be non-blocking, I should be able to do select() in my event loop, but actual packet reading can be still done by pcap_next()? I don't need to read() on pcap handle. Right? Thanks for your answer, Przemek On Tue, 2002-07-16 at 14:21, Guy Harris wrote: > On Tue, Jul 16, 2002 at 11:29:42AM -0400, Przemyslaw Karwasiecki wrote: > > My major problem is, how (if at all possible) use pcap in nonblocking > > mode, > > In libpcap 0.7 and later, there are "pcap_setnonblock()" and > "pcap_getnonblock()" calls, to turn non-blocking mode on and off on a > live-capture pcap_t. > > In earlier versions, on UNIX, you can probably just set the O_NONBLOCK > flag on the file descriptor for the pcap_t - use "pcap_fileno()" to get > the file descriptor. (That is not guaranteed to work in the future - > for example, it won't work if libpcap is using the memory-mapped capture > buffer feature from Linux 2.4, as reads aren't done on the file > descriptor - so, for UNIX, you should use autoconf to determine whether > the libpcap you're using has "pcap_setnonblock()" and > "pcap_getnonblock()" and, if it doesn't, supply your own routines that > use the O_NONBLOCK stuff.) > > In non-blocking mode, reads from a live-capture "pcap_t" will be > non-blocking. > > > so my application will have main event loop processing > > in non-blocking mode, both pcap_next packets, and SNMP requests? > > On UNIX, you'd do a "select()" or "poll()" on the file descriptor from > "pcap_fileno()" and the file descriptor of the socket on which the SNMP > requests arrive. > > Note, however, that "select()" and "poll()" don't necessarily work on > BPF devices in BSD. A workaround is to have a timeout on the "select()" > or "poll()", equal to the timeout you supplied to "pcap_open_live()", > and attempt to read from the pcap_t if either > > 1) its file descriptor can be read, according to "select()" or > "poll()" > > or > > 2) the timeout expired. > > Note also that this might not work on FreeBSD 4.5 - I've yet to figure > out whether it's possible to make that type of non-blocking I/O work > there. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
