Christopher Pohl
|
libpcap: pcap_open_live with no read timeout (to_ms=0)
|
Christopher Pohl
07/18/2008 9:00 AM
post10697
|
libpcap: pcap_open_live with no read timeout (to_ms=0)
Hi all,
I'm experimenting with the pcap library and I open it in the following way:
pcap_open_live("tsec0", 1500, 1, 0, ebuf);
i.e. I'm using a zero read timeout for the BPF device.
The filter is setup to capture small amounts of packets every few seconds.
Later on I use pcap_loop() to receive packets.
My expectation from reading various man pages about libpcap was to be immediately be notified of any arriving packet
when using this zero timeout live capture setup.
However, it seems to me that I am getting notified of a whole bunch of frames at once , as soon as ~1500 bytes (the
snaplen) of frames have arrived (considerable delay w.r.t. to the arrival of the first frame).
Is the latter how it's supposed to be behave on QNX ? If so, is there any way to be immediately notified ?
BTW, the source file ./dist2/libpcap/pcap-bpf.c::pcap_open_live() line ~900++ contains a comment about this kind of
behaviour on AIX and different variants of BSD.
Thanks for any help.
Christopher
|
|
|