Re: When will a packet filter be ignored/unused?

[Guy Harris <guy () alum mit edu>]

On Mar 17, 2010, at 10:54 AM, Jim Lloyd wrote:

> So, what does an error code of -3 indicate?

        #define PCAP_ERROR_NOT_ACTIVATED        -3      /* the capture needs to be activated */

> I've done some experimentation and determined that apparently I must call
> pcap_activate before calling pcap_setfilter.

Yes.

> That is counter intuitive, so I wonder if it is by design or not.

It may change at some point.  It is, however, currently a requirement (on all platforms).  It is also a requirement 
that the pcap_t be activated before you call pcap_compile(); lifting *that* restriction would require that we be able 
to get the link-layer type for the device before activating it, which may or may not be easy to do.

I will update the documentation to indicate that the operations in question (pcap_datalink(), pcap_compile(), 
pcap_setfilter()) require that the pcap_t be activated *and* make what code changes are necessary to arrange that they 
fail on un-activated pcap_t's.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.