Re: error executing ksniff with libpcap 1.0.0

[Giovanni Venturi <giovanni () ksniffer org>]

Alle mercoledì 19 novembre 2008, Guy Harris ha scritto:
> On Nov 17, 2008, at 1:46 PM, Giovanni Venturi wrote:
> > To make the pcap_next/pcap_ex non blocking under Linux I use:
> >
> >    FD_ZERO(&m_fdset);
> >    FD_SET(m_pcap_fd, &m_fdset);
> >    m_fdtimeout.tv_sec = 0;
> >    m_fdtimeout.tv_usec = CAP_READ_TIMEOUT*1000;
> >    selRet = select(m_pcap_fd+1, &m_fdset, NULL, NULL, &m_fdtimeout);
>
> How is that "non-blocking"?  That select() call blocks until either
> m_pcap_fd is readable or the timeout expires.
I mean "non-blocking" in the sense that I can set a small timeout and return 
also each 1 second or less, so If I never get a packet I can quit from the 
application if I want sniff just for 10 minutes for example. If I don't do so 
and If I never get a packet I will always blocked on the pcap_next_ex() 
reading.
> > No possibility to delete this ugly code with libpcap 1.0.0?
> > I've seen:
> >
> > int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);
> >
> > Doesn't work under Linux?
>
> It worked when I tested it; what do you mean by "doesn't work"?
It's a question :) . I mean I need a way to wait for packets not more than X 
msec If I don't get any packets and I'd like to get rid of the select() .

> (Be aware that the timeout argument to pcap_open_live() has *never*
> been guaranteed to ensure that pcap_next()/pcap_next_ex() will return
> within the timeout period.  It only guarantees that, *if* at least one
> packet has been captured, the application will never wait longer than
> the timeout period to see that packet; it might wait less, but that's
> not guaranteed.
[cut]

This means that it's not as I intended: "a way to wait for packets not more 
than X msec If I don't get any packets and I'd like to get rid of the 
select()".
The timeout in pcap_open_live() means that I wait that time and than I return 
from the function. I can use a very small time, but this doesn't assure me 
that when I get a packet pcap_next_ex() return at once. It has to wait the 
fixed timeout anyway.
Thank you for your time and information,

Giovanni
-- 
A KDE Italian translator and KSniffer core developer
Slackware GNU/Linux current version - kernel 2.6.27.6
KSniffer Project - http://www.ksniffer.org/

Attachment: signature.asc
Description: This is a digitally signed message part.