Re: buffering packets with libpcap 1.0.0

[Guy Harris <guy () alum mit edu>]

On Oct 24, 2009, at 8:53 AM, Virgil Mihailovici wrote:

> Thanks a lot for your reply. I understand the fact that I am going  
> to consume kernel memory to buffer packets, but can I keep the  
> buffer in use and the let the app free it? Like set the status to  
> TP_STATUS_KERNEL when app is done with it? Would that work?

You could try implementing your own code, rather than using libpcap,  
and see whether you can make that work.  (Linux-only, of course.   
FreeBSD's memory-mapped capture works differently - for example, you  
don't release individual packets, you release an entire bufferful of  
packets with an ioctl.)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.