Re: Re: libpcap 0.7.2 (was: nessus and AMD64 again)

On Fri, 16 Jan 2004, Renaud Deraison wrote:

> > This is wierd. I have checked it can handle as much as 1000 simultaneously
> > open and listening pcap's (0.7.2 on 2.4 kernel).
> 
> Interesting. I actually was using a 2.2 kernel when I did my tests,
> maybe that's why.

Hmm...I guess I'll try the same stress test on 2.2.

> > > Also I'd need to make sure that pcap 0.7.x is non-blocking on Linux
> > > (the older "stock" pcap libraries were blocking - ie:  pcap_read()
> > > would not return until a packet hits the filter).
> > 
> > I myself have been using Fyodor's patch that makes pcap_next() return
> > after the timeout specified by pcap_open_live() but it appears the
> > the timeout was meant to have other meaning and the right was is to
> > set the fd nonblocking (it works on Linux).
> 
> That's a linux specific hack. That somehow defeats the purpose of using
> libpcap in the first place...

The timeout it pcap_open_live() was never intended to be a portable
mechanism to make libpcap operate in a nonblocking way. See:

http://www.tcpdump.org/lists/workers/2000/msg01674.html
http://www.tcpdump.org/lists/workers/2000/msg01730.html
http://www.tcpdump.org/lists/workers/2001/01/msg00038.html

0.7.x adds a (presumably) portable way to put pcap into a nonblocking way
(pcap_setnonblock()), and 0.8 adds explicit support for select()/poll() on
nonblocking pcaps (pcap_get_selectable_fd(), yet to be documented).

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel