tcpdump mailing list archives
pcap_breakloop help
From: "Joe Shaw" <JShaw () evitechnology com>
Date: Wed, 06 Dec 2006 16:04:23 -0500
Hello, I am new to pcap programming. I'm having issues with pcap_loop not exiting when I give the pcap_breakloop command. I read where it should be executed by a signal handler that doesn't restart system calls. I believe I am doing this, but pcad_loop still waits for one last packet before exiting. Thanks in advance for any help. -Joe static sem_t pcap_sem; static char filter_exp[100]; static unsigned char capture_packets; pcap_t* handle; static void sig15(int sig) { capture_packets = 0; pcap_breakloop(handle); } void pcap_cb (u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data) { if (pkt_data) syslog(LOG_INFO, "Got packet: %d bytes captured:", pkt_header->caplen); } void * pcap_main(int *a) { char *dev, errbuf[PCAP_ERRBUF_SIZE]; bpf_u_int32 mask, net; struct bpf_program fp; if (signal(15, sig15) == SIG_ERR) { perror("SIGNAL"); syslog(LOG_INFO, "Error installing sig15 handler %m"); exit(-1); } siginterrupt(15, 1); capture_packets = 0; if (sem_init(&pcap_sem, 0, 1) <0) syslog(LOG_INFO,"pcap_main: Failure to initialize semaphore\n"); sem_wait(&pcap_sem); dev = pcap_lookupdev(errbuf); handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf); while (1) { sem_wait(&pcap_sem); if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) { syslog(LOG_INFO,"Couldn't parse filter %s: %s", filter_exp, pcap_geterr(handle)); capture_packets = 0; } else if (pcap_setfilter(handle, &fp) == -1) { syslog(LOG_INFO,"Couldn't install filter %s: %s", filter_exp, pcap_geterr(handle)); capture_packets = 0; } while (capture_packets > 0) { syslog(LOG_INFO, "Waiting to capture packet"); pcap_loop(handle, -1, pcap_cb, NULL); syslog(LOG_INFO, "Done capturing packets"); } pcap_freecode(&fp); } } void start_capture(unsigned long ccAddr, char* filter) { strcpy(filter_exp, filter); capture_packets = 0x0F; //anything greater than 0 sem_post(&pcap_sem); } void stop_capture(){ raise(15); } - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- pcap_breakloop help Joe Shaw (Dec 06)