On Sun, Feb 01, 2004 at 11:24:27AM -0800, Richard Sharpe wrote:
> I can see that it might be possible under UNIX to use select or poll and
> to open up several /dev/bpfN devices,
Or, rather, several live-capture pcap_t's, whether they're implemented
with /dev/bpfN or PF_PACKET sockets or DLPI devices or....
Also, see my comments on the problems with "select()" and "poll()" on
BPF devices.
> Another possible approach might be to modify the Berkeley Packet Filter
> code to allow capture on multiple interfaces with the same filter
> applying.
That works only if either
1) that's done with a synthetic link-layer header, so that the
same BPF code can be made to work on multiple link-layer
types;
2) you limit that mechanism to interfaces of the same type
(e.g., you don't get to capture on Ethernet and PPP links at
the same time);
3) you supply multiple BPF programs for different link-layer
types.
_______________________________________________
Ethereal-dev mailing list
[EMAIL PROTECTED]
http://www.ethereal.com/mailman/listinfo/ethereal-dev
