Re: start pcap in two thread

[Guy Harris <guy () alum mit edu>]

On Feb 9, 2009, at 8:54 AM, David Andrey wrote:

> I open two different pcap_t's and become two different handles. The
> filter are different, but with low differences ( AND operation on 1
> byte).
>
> @Guy
> You say that "filters aren't per-thread" ... does it mean that the
> second filter "delete" the first one ?

No.

Filters are per-pcap_t, so if the two threads have different pcap_t's,  
the two threads can have different filters.

If two threads read from the *same* pcap_t, they can't have different  
filters.  We don't support multiple threads reading from the same  
pcap_t in any case.

> @Gianluca
> "that function is not thread safe" ... do you mean a special one or  
> all
> functions of pcap ?

He means pcap_compile().  You should do all pcap_compile()s in a  
single thread, or have a global mutex to ensure that only one thread  
is running pcap_compile() at a time.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.