On Thu, Mar 29, 2001 at 07:56:55PM +0000, Sebastian Proba wrote:
> I would like to ask you a question about pcap library. I try to use function
> pcap_loop on a loopback device.
On what OS? (I assume it's probably either some Linux distribution or
some flavor of BSD - or *maybe* Digital UNIX, although I don't remember
whether I got it to work there or not - as, on at least some other OSes,
you can't capture on the loopback device.)
> My callback function is quite simple, it just
> gets sequence field from ICMP and prints it. When I run my program and start
> to ping the lo device the program produces strange output. My callback
> function is called four time for every packet arrived.
The callback routine for "pcap_loop()" is passed data for a packet, so
if it's called four times for every packet, presumably one of those
times you get the actual packet data - what is it getting passed on the
other three calls? (Note that on Linux, versions of libpcap prior to
0.6 supplied two copies of every packet sent over the loopback
interface, due to the way the loopback interface code works; libpcap 0.6
and later throw away one of those copies, so you see only one copy.)
> What's more, i tried to slow down
> my callback function by using a loop. For 65535 empty iterations there was
> the same effect but for 65536 iterations my program catches only the first
> packet and then starts to behave like there was no more traffic. What is the
> problem?
I.e., the loop is something such as
for (i = 0; i < {number of iterations}; i++)
;
which just spends CPU time idling?
If so, it's a bit unusual that there's a difference between 65535 and
65536 - it's odd enough that one iteration would make a big difference,
but it's *very* odd that the difference between looping 2^16-1 and 2^16
times would make a difference; i.e., this suggests that there's some
16-bit variable involved in the loop.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
