Re: Re: libpcap 0.7.2 (was: nessus and AMD64 again)
Renaud Deraison <[email protected]>
| Newsgroups | gmane.comp.security.nessus.devel |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Jan 16, 2004 at 02:39:44AM +0100, Pavel Kankovsky wrote: > On Thu, 8 Jan 2004, Renaud Deraison wrote: > > > I have had numerous issues with libpcap 0.7.x on Linux. It seems that > > they try to use the bpf-like architecture offered by the kernel, but > > libpcap 0.7.x hates to have too many pcap descriptors open at the same > > time. The solution would be to use the userland pcap workaround I use > > for BSD systems now that it's been extensively tested. > > This is wierd. I have checked it can handle as much as 1000 simultaneously > open and listening pcap's (0.7.2 on 2.4 kernel). Interesting. I actually was using a 2.2 kernel when I did my tests, maybe that's why. > > Also I'd need to make sure that pcap 0.7.x is non-blocking on Linux > > (the older "stock" pcap libraries were blocking - ie: pcap_read() > > would not return until a packet hits the filter). > > I myself have been using Fyodor's patch that makes pcap_next() return > after the timeout specified by pcap_open_live() but it appears the > the timeout was meant to have other meaning and the right was is to > set the fd nonblocking (it works on Linux). That's a linux specific hack. That somehow defeats the purpose of using libpcap in the first place... -- Renaud _______________________________________________ Nessus-devel mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus-devel