Filter Question: Indication between Kernel/User Space Filtering

[Uri Schneider <uri.s () correlix com>]

Hi,


I am using libpcap in a Linux program which captures live traffic from a 
network interface.  The program is able to read a filter from an 
external file.


Sometimes the filter is too big for the kernel to handle, and a warning 
is printed to the standard error: "Warning: Kernel filter failed: cannot 
allocate memory" (or something similar).  If I understand correctly, 
libpcap does not treat this as an error, but rather filters packets in 
user space.


Now, we would like to know if we cannot filter in kernel space, and stop 
the program.  The performance penalty for filtering in user space is not 
acceptable for us.


My question is, is there a way to tell whether I am filtering in the 
kernel or in user space, after calling pcap_setfilter()?  The only idea 
I came up with is searching the standard error for this particular 
warning, but that doesn't seem like a very good idea.


Any other suggestions?


Thank you,

--

Uri Schneider

Correlix

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.