Re: capturing on both interfaces simultaneously

[abhinav narain <abhinavnarain10 () gmail com>]

So,  I can do select + pcap_dispatch to read on two interfaces without even
using threads.

I read select is slow for monitoring. But with only two interfaces, it
should not be a problem.

Abhinav

On Sat, Dec 10, 2011 at 3:50 PM, Guy Harris <guy () alum mit edu> wrote:

> On Dec 10, 2011, at 7:39 AM, abhinav narain wrote:
>
> > Can I use pcap_loop when using select,
>
> No.
>
> You can, however, use pcap_dispatch().  pcap_loop() loops either
> indefinitely or until it sees the specified number of packets; it will try
> to read more packets from the underlying descriptor, and thus potentially
> block.  pcap_dispatch() will read more packets from the descriptor at most
> once, so it's more appropriate to call if select() or poll() reports the
> selectable descriptor for a pcap_t as having packets available.  Pass it a
> "cnt" argument of -1, so it processes all the packets in the batch that it
> reads, and thus does a read at the beginning of each call.-
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.