Re: start pcap in two thread

["Gianluca Varenni" <gianluca.varenni () cacetech com>]

----- Original Message ----- 
From: "Guy Harris" <guy () alum mit edu>
To: <tcpdump-workers () lists tcpdump org>
Sent: Friday, February 06, 2009 11:06 AM
Subject: Re: [tcpdump-workers] start pcap in two thread


> On Feb 6, 2009, at 7:24 AM, David Andrey wrote:
>
> > Can 2 threads (in the same process)  start each one a sniffing session
> > on the same interface, but with different filter. Is it safe and
> > reliable ?
>
> It should work *IF* each thread opens a separate pcap_t for the  interface 
> and sets its own filter for the interface.
>
> > I'm using Linux 2.6.27 and made some tests. It seems that one thread
> > catch all the frames ?!
>
> Did you open two different pcap_t's in the two threads, or are the two 
> threads sharing the same pcap_t?  Individual pcap_t's cannot be shared  by 
> a thread - and filters aren't per-thread.
>
> If you opened two different pcap_t's, are you sure that the filter for 
> the thread that's not capturing any frames will actually match any  frame?

Also, be careful with pcap_compile. Unless something changed in the latest 
versions of libpcap, that function is not thread safe, as it uses some 
global variables.

Have a nice day
GV

> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe. 

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.