Re: libpcap on Mac Os X 10.6 Snow Leopard

[Carter Bullard <carter () qosient com>]

Hey Marco,
This may help you if you are not doing it.  It seemed to help me on Snow Leopard.

Just after the call to pcap_open_live(), I set this ioctl.  You may not need the pcap_setnonblock() for
your application.

   if ((pd = pcap_open_live(device->name, snaplen, !pflag, 100, errbuf)) != NULL) {
      pcap_setnonblock(pd, 1, errbuf);

#if defined(__APPLE_CC__) || defined(__APPLE__)
      int v = 1;
      ioctl(pcap_fileno(pd), BIOCIMMEDIATE, &v);
#endif


Carter


On Feb 9, 2010, at 5:15 AM, Marco De Angelis wrote:

> Guy Harris <guy <at> alum.mit.edu> writes:
>
> > > Good question. Do you know how could I verify the buffer 
> > > they stay in? Is there
> > > some printout I could add before calling pcap_dispatch to see 
> > > what's in the kernel buffer and what in the userland buffer?
> >
> > Yes, but you'd have to add it to libpcap. 
>
> I made an interesting test.
> By collecting pcap_stats() after every call to pcap_dispatch and 
> printing the pcap_stat values out, I could verify that the packets 
> are received. 
> E.g. if I filter for ICMP packets, by launching "ping" commands 
> I can see "ps_recv" increase rapidly. 
>
> Now, I don't know what "received" means (in userland? in kernel 
> buffer?), but maybe you do :)
>
> Thanks,
> Marco
>
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.

Attachment: smime.p7s
Description: