Re: mmap in libpcap

[Guy Harris <guy () alum mit edu>]

On Aug 13, 2009, at 7:02 PM, Sashan Govender wrote:

> Will libpcap 1.0.0 use mmap packets if the linux kernel has  
> CONFIG_PACKET_MMAP
> enabled?

If it was built on the same version of the OS as the one on which it's  
running, yes; that should be the case, for example, with versions of  
libpcap supplied with Linux distributions.

> As far as I can tell, there's code in libpcap to use the mmaped  
> sockets
> but it's not used unless HAVE_PACKET_RING is defined?

Yes.

HAVE_PACKET_RING is defined in pcap-linux.c with

#ifdef PF_PACKET
# include <linux/if_packet.h>

        ...

 /* check for memory mapped access avaibility. We assume every needed
  * struct is defined if the macro TPACKET_HDRLEN is defined, because  
it
  * uses many ring related structs and macros */
# ifdef TPACKET_HDRLEN
#  define HAVE_PACKET_RING
#  ifdef TPACKET2_HDRLEN
#   define HAVE_TPACKET2
#  else
#   define TPACKET_V1   0
#  endif /* TPACKET2_HDRLEN */
# endif /* TPACKET_HDRLEN */
#endif /* PF_PACKET */

so it's defined if PF_PACKET is defined and TPACKET_HDRLEN is defined.

PF_PACKET is defined by including <sys/socket.h>, which pcap-linux.c  
includes.  It should be defined on any system using a Linux 2.x kernel.

TPACKET_HDRLEN is defined by including <linux/if_packet.h>, which pcap- 
linux.c includes if PF_PACKET is defined.  It should be defined on any  
system where the kernel can be configured to support  
CONFIG_PACKET_MMAP, regardless of whether the kernel on that system  
has it configured or not.

If libpcap is compiled to support the mmap interface, but the kernel  
doesn't have CONFIG_PACKET_MMAP enabled, the attempts to use the mmap  
interface will fail, and libpcap will fall back on doing recvfrom()  
calls on the socket.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.