Re: capturing on both interfaces simultaneously

["David Laight" <David.Laight () ACULAB COM>]

> > That poll() is unnecessary in non-blocking mode only if the 
> > application isn't expecting libpcap to return errors, and is 
> > itself checking for those errors after the poll() call.  That 
> > would be the case only if the application knew it had to do 
> > that special Linux-specific stuff. 
>
> Perhaps it could be done every 256'th time through.
> That would pick up an actual error quite quickly, but
> reduce the overhead a lot.

Actually skip the poll if a packet has been found since
the last time the check was done.

Then code that does:
        select(...)
        while (read_packet())
                ...
        done;
won't call poll() inside the library every time it
finishes processing the available data.
But if there is a failure, it will be detected immediately.

        David


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.