Re: capturing on both interfaces simultaneously

[rixed () happyleptic org]

Hi!

> I was using pthreads for two interfaces, but I am trying to optimize now. I
> have 15% memory usage.

So you were capturing traffic on two threads with two distinct pcap handlers?
Looks fine to me. What's eating 15% of your RAM, exactly?

> I am trying to use select, as it seems the most basic.

If I understand correctly, you are replacing your threaded aproach by a singly
threaded program using select. Unfortunately, I don't know any way to
associate a file descriptor with a pcap handle portably. :-(

> Junkie uses threads to do this, so can't really use it.

Yes junkie uses one thread per interface.  The reason behind this is that I use
it to perform a lot of process for every packet so using threads on many
interfaces offer as much parallelism as necessary (even when you are interested
in only one device you can still scatter its traffic through several handlers
by proper filtering).

> Can I use pcap_loop when using select, or i have to use recvfrom in loop ?

I think you will be forced into recvfrom, which is not as portable as plain
libpcap so from my very limited knowledge I would recommend against it.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.