Tobias Ulmer wrote:
> On Tue, Sep 22, 2015 at 11:46:08AM -0400, Ted Unangst wrote:
> > Todd C. Miller wrote:
> > > On Mon, 21 Sep 2015 20:13:05 -0400, "Ted Unangst" wrote:
> > >
> > > > We can put a "long" poll() in front of pcap to wait until there are
> > > > packets
> > > > (maybe never if you aren't using pf logging), and then let the timeout
> > > > work
> > > > it's magic.
> > >
> > > This:
> > >
> > > > + if (poll(&pfd, 1, INFTIM) == 1) {
> > >
> > > will also match POLLHUP and POLLERR which doesn't appear to be what
> > > you want. You need to explicitly check for pfd.revents & POLLIN.
> >
> > poll, you sneaky bastard. I wonder if this program could also benefit from
> > handling signals via kevent, but that's a bigger change.
> >
>
> WIP:
>
> - hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
> + hpcap = pcap_open_live(interface, snaplen, 1, 0, errbuf);
I believe we want to keep that. We poll until there are packets, but then we
want to collect packets for as long as the timeout.
