Blocking mode

<[email protected]> 21 Jun 2004 23:08:19 -0000
Newsgroups gmane.comp.security.libnet
Message-ID <[email protected]>

hi

I know this is mostly about libnet library mailing list,but since your book talks about lipcap and since tcpdump mailing list admins still(after few days) didn't register me,I figured you may be willing to help me:)

I have red hat 9

I know that under linux one packet per read is returned and so setting timeout value in call to pcap_open_live() won't do any good.But here are few things I don't understand:

-pcap_dispatch() takes as one of the arguments a value that tells it how many packets to read before it should returns.But in my case it always returns only one packet.I know read returns only one packet,but doesn't pcap_dispatch() just calls read function more times so that it can deliver up-to specified number of packets or at least until one of its buffers is full?

-I also thought that if you don't specify timeout value(in call to pcap_open_live) that pcap_dispatch() will block until it gets a packet.But in my case it only blocks for 3 or 4 seconds and then it returns,even if no packet 
was read.I tried with pcap_setnonblock() but didn't help.
I did observe one thing tho...If I set it to nonblocking mode then pcap_dispatch() returns right away and doesn't wait for few secons like in blocking mode

thank you and sorry for the troubles