Re: Packet arrival order

["roy hills" <royhills () hotmail com>]

> I've also had problems with Solaris. In my opinion it's not the
> best platform for capturing packets in real-time. In Network Expect
> (http://www.netexpect.org) I am currently using the following code,
> which I borrowed from another open source project (can't remember
> which):
>
> [snip]

Great - that works.  Thanks.

> If I remember correctly this makes things "pseudo work" since now
> select() will return immediately but regardless of whether there's
> data ready to be read. But at least this is better than select() not
> returning at all since your code can check for select()'s return value
> and read data if there's something to read or go back to select() if
> there's nothing.

I'll need to check on how select() is behaving, but it is working, and
I'm only calling pcap_dispatch() if select() indicates that the pcap fd
is readable.

> As I said, Solaris behaves really weird when using select() on a libpcap
> packet capture descriptor. I can't explain it.

I think there is a need for documentation on libpcap implementation-specific
differences.  I found that Linux (packet socket) just worked, but I then had
to alter the code for BSD (BPF) to prevent buffering and work around
a select() issue, and I'm now having similar problems with Solaris (DLPI).
I bet loads of people must go through this sort of thing.

_________________________________________________________________
Get Hotmail, News, Sport and Entertainment from MSN on your mobile.  
http://www.msn.txt4content.com/

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.