Hi, Below is a patch that makes breaking out of the loop work when using a savefile.
The pcap_breakloop() function was backported from tcpdump.org libpcap to OpenBSD libpcap by djm@ on Nov 18, 2005. The bits to make pcap_breakloop() work were backported to pcap-bpf.c [1] but not to savefile.c even though tcpdump.org implemented support there too [2]. The diff below backports this piece of code to savefile.c after all. Thanks, Caspar Schutijser [1] https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libpcap/pcap-bpf.c.diff?r1=1.16&r2=1.17 [2] https://github.com/the-tcpdump-group/libpcap/commit/991d444f7116bef16893826b46f3950f62281507#diff-95d4d29d0f11145ff40b850860667a97R745 Index: savefile.c =================================================================== RCS file: /cvs/src/lib/libpcap/savefile.c,v retrieving revision 1.16 diff -u -p -r1.16 savefile.c --- savefile.c 22 Dec 2015 19:51:04 -0000 1.16 +++ savefile.c 15 May 2020 19:03:44 -0000 @@ -307,6 +307,23 @@ pcap_offline_read(pcap_t *p, int cnt, pc while (status == 0) { struct pcap_pkthdr h; + /* + * Has "pcap_breakloop()" been called? + * If so, return immediately - if we haven't read any + * packets, clear the flag and return -2 to indicate + * that we were told to break out of the loop, otherwise + * leave the flag set, so that the *next* call will break + * out of the loop without having read any packets, and + * return the number of packets we've processed so far. + */ + if (p->break_loop) { + if (n == 0) { + p->break_loop = 0; + return (PCAP_ERROR_BREAK); + } else + return (n); + } + status = sf_next_packet(p, &h, p->buffer, p->bufsize); if (status) { if (status == 1)
