Re: Libpcap reentrancy and PF_RING patch

[Luca Deri <deri () ntop org>]

On Jan 5, 2008, at 11:52 PM, Guy Harris wrote:

> Luca Deri wrote:
>
> > On Dec 31, 2007, at 10:21 PM, Guy Harris wrote:
> > > You might want to split the PF_RING support and the reentrancy  
> > > changes into two patches.
> > I have enclosed the patch for PF_RING.
>
> I've checked in Paolo Abeni's patch for memory-mapped PF_PACKET  
> access; your patch isn't a context or unified diff, so it probably  
> won't apply correctly to the current code.  Could you get the latest  
> top-of-tree code, merge it with your changes, and send a new  
> (context diff or unified diff) patch?

I'll do this.

> > > There is at least one place where the behavior of libpcap is  
> > > modified at compile time with "#ifdef HAVE_PF_RING" - the code to  
> > > get the packet statistics.  If you install a libpcap with  
> > > HAVE_PF_RING defined on a system that doesn't have the PF_RING  
> > > module installed, that means that the statistics code's behavior  
> > > will be changed - will that code still work on that system?
> > The idea is that in order to compile the pcap library with the  
> > extension, configure checks whether the header files and library  
> > are installed. if so the patch is enabled and the pcap library is  
> > compiled with PF_RING support enabled. In case you use pcap+  
> > PF_RING on a linux box where the pf_ring module has not been  
> > loaded, pf_ring will not be enabled and the library will work as if  
> > it were unpatched.
>
> Yes, but if you *build* on a system with PF_RING support enabled,  
> and then use that version on a system without PF_RING support (which  
> might be the same system, if the PF_RING module is removed), will it  
> work correctly?

Yes it will work correctly as when the PF_RING socket is open, the  
call will fail and the library will fall back to standard pcap.  
However please understand that contrary to memory-mapped PF_PACKET  
access, I have put all the PF_RING related routines into libpfring  
(and not into the libpcap code) that comes with PF_RING. This means  
that the pcap-based application needs to be linked with such library.

Regards, Luca

> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.