Re: libpcap on Mac Os X 10.6 Snow Leopard

[Guy Harris <guy () alum mit edu>]

On Feb 9, 2010, at 9:41 AM, Carter Bullard wrote:

> Just after the call to pcap_open_live(), I set this ioctl.  You may not need the pcap_setnonblock() for
> your application.
>
>   if ((pd = pcap_open_live(device->name, snaplen, !pflag, 100, errbuf)) != NULL) {

That's a sub-second timeout, which definitely *won't* work in 64-bit mode on 10.6 and 10.6.1, but should work in 10.6.2 
(and in 10.5.x and earlier).  On 10.6 and 10.6.1, you'd see the symptoms you described, because the timeout would be 
set to, in effect, 0, meaning "no timeout", so the packets won't be delivered until the "store buffer" fills up with 
packets.  Setting BIOCIMMEDIATE mode means that packets will not be buffered at all, so they're delivered as soon as 
they arrive.

It seems unlikely that, at least in 64-bit mode, the problem would have *started* with an upgrade from 10.6 or 10.6.1 
to 10.6.2; that upgrade fixed a similar problem with Wireshark.  If it's still there with 10.6.2, as you and Marco note 
is the case, something else is happening; I'll look into that.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.