Re: capturing on both interfaces simultaneously

[abhinav narain <abhinavnarain10 () gmail com>]

On Sat, Dec 10, 2011 at 3:18 PM, <rixed () happyleptic org> wrote:

> Hi!
>
> > I was using pthreads for two interfaces, but I am trying to optimize
> now. I
> > have 15% memory usage.
>
> So you were capturing traffic on two threads with two distinct pcap
> handlers?
yes

> Looks fine to me. What's eating 15% of your RAM, exactly?
I think pthread while keeping the states

> > I am trying to use select, as it seems the most basic.
>
> If I understand correctly, you are replacing your threaded aproach by a
> singly
> threaded program using select. Unfortunately, I don't know any way to
> associate a file descriptor with a pcap handle portably. :-(
>
> > Junkie uses threads to do this, so can't really use it.
>
> Yes junkie uses one thread per interface.  The reason behind this is that
> I use
> it to perform a lot of process for every packet so using threads on many
> interfaces offer as much parallelism as necessary (even when you are
> interested
> in only one device you can still scatter its traffic through several
> handlers
> by proper filtering).
>
> > Can I use pcap_loop when using select, or i have to use recvfrom in loop
> ?
>
> I think you will be forced into recvfrom, which is not as portable as plain
> libpcap so from my very limited knowledge I would recommend against it.
>
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.