Re: Compatibility Libpcap/Winpcap and timout of

[Guy Harris <guy () alum mit edu>]

On Jan 27, 2009, at 5:14 PM, Aaron Turner wrote:

> What is the solution on *BSD/OS X where you want a timeout

If you want a timeout, in the sense of something that means that  
you'll *never* block forever waiting for packets to arrive, then:

	if you *only* care about platforms where the timer starts when the  
read starts - i.e., you don't care about, for example, Solaris or  
Linux - you can use the libpcap timeout;

	if you *do* care about those platforms, you have to use select() (or  
poll(), if you don't care about OS X) even if you *aren't* trying to  
multiplex I/O on multiple pcap_t's or on one or more pcap_t's and  
other input sources.  See below for the rules on using select() or  
poll().

> or need to listen on multiple pcap_t handles?

If

	1) you only care about sufficiently recent version of *BSD, not about  
older BSDs where select() doesn't work right with BPF devices

and

        2) you don't care about Mac OS X

just use select() or poll().

If you care about the older versions of various BSDs, or about Mac OS  
X, then:

	1) unless you don't care about Mac OS X after 10.3, don't use poll()  
(which means you can't use, for example, the GLib event loop) and  
don't use kqueues (as neither of those work with *any* character  
special files on OS X releases starting with 10.4 - this includes ttys  
as well);

        2) put all the pcap_t's into non-blocking mode;

        3) use select(), and put a timeout in the select() call;

	4) attempt to read from all of the pcap_t's *regardless* of whether  
select() says they're readable or not (that's why you put them into  
non-blocking mode).

Note that this is the right way to handle multiple pcap_t's on *all*  
UN*Xes, regardless of how the timeout happens to work on particular  
platforms; don't use the timeout to do multiplexing.

Note also that, if the version of libpcap you're using has  
pcap_get_selectable_fd(), use that to get the file descriptor to use  
with select() or poll(); otherwise, use pcap_fileno().

On Windows, if you're trying to multiplex multiple pcap_t's, or one or  
more pcap_t's and other event sources, use WaitForMultipleObjects()/ 
WaitForMultipleObjectsEx()/MsgWaitForMultipleObjects()/ 
MsgWaitForMultipleObjectsEx(); use pcap_getevent() to get the event  
handle for a pcap_t.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.