Re: Legacy Linux kernel support

[Guy Harris <gharris () sonic net>]

On Oct 7, 2019, at 12:55 PM, Mario Rugiero <mrugiero () gmail com> wrote:

> El lun., 7 oct. 2019 a las 16:07, Guy Harris (<gharris () sonic net>) escribió:
>
> > So are you saying that, even if you're using libpcap to implement a protocol running directly atop the link layer, 
> > rather than passively sniffing traffic, you still get a packet firehose?
> No, I get a packet fire hose because I passively sniff.

And presumably you're not doing that in immediate mode.  (tcpdump *currently* uses immediate mode if it's in 
sniff-and-print mode, but maybe it should select a shorter timeout instead - and perhaps, these days, a 1-second 
timeout is too much even if you're capturing to a file.)

> The protocol idea is new to me.

And that's where I'm saying we might want to use non-memory-mapped capturing.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers