Re: libpcap 0.7.2 (was: nessus and AMD64 again)

On Thu, 8 Jan 2004, Renaud Deraison wrote:

> I have had numerous issues with libpcap 0.7.x on Linux. It seems that
> they try to use the bpf-like architecture offered by the kernel, but
> libpcap 0.7.x hates to have too many pcap descriptors open at the same
> time. The solution would be to use the userland pcap workaround I use
> for BSD systems now that it's been extensively tested.

This is wierd. I have checked it can handle as much as 1000 simultaneously
open and listening pcap's (0.7.2 on 2.4 kernel).

> Also I'd need to make sure that pcap 0.7.x is non-blocking on Linux
> (the older "stock" pcap libraries were blocking - ie:  pcap_read()
> would not return until a packet hits the filter).

I myself have been using Fyodor's patch that makes pcap_next() return
after the timeout specified by pcap_open_live() but it appears the
the timeout was meant to have other meaning and the right was is to
set the fd nonblocking (it works on Linux).


--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel