Re: start pcap in two thread

[Guy Harris <guy () alum mit edu>]

On Feb 6, 2009, at 7:24 AM, David Andrey wrote:

> Can 2 threads (in the same process)  start each one a sniffing session
> on the same interface, but with different filter. Is it safe and
> reliable ?

It should work *IF* each thread opens a separate pcap_t for the  
interface and sets its own filter for the interface.

> I'm using Linux 2.6.27 and made some tests. It seems that one thread
> catch all the frames ?!

Did you open two different pcap_t's in the two threads, or are the two  
threads sharing the same pcap_t?  Individual pcap_t's cannot be shared  
by a thread - and filters aren't per-thread.

If you opened two different pcap_t's, are you sure that the filter for  
the thread that's not capturing any frames will actually match any  
frame?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.