Re: [tcpdump-workers] tcpdump vs libpcap : CPU usage shooting high for two simultaneous captures on wireless monitor interfaces

2013-04-18 Thread abhinav narain
Hi Guy, This is one thing I am confused about. I am right now setting the sigprocmask in the callback function : pkt_callback(...){ if (sigprocmask(SIG_BLOCK, &block_set, NULL) < 0) { perror("sigprocmask"); exit(1); } code ... if (sigprocmask(SIG_UNBLOCK, &block_set, NULL) < 0) {

Re: [tcpdump-workers] tcpdump vs libpcap : CPU usage shooting high for two simultaneous captures on wireless monitor interfaces

2013-04-18 Thread abhinav narain
On Thu, Apr 18, 2013 at 8:37 AM, abhinav narain wrote: > hi Guy, > > What happens if you eliminate that (and any code paths that eliminating >> that breaks)? >> >> The biggest issue for me to understand is, why is the CPU usage going up when two instances of the tool run simultaneously. It doesn't

Re: [tcpdump-workers] tcpdump vs libpcap : CPU usage shooting high for two simultaneous captures on wireless monitor interfaces

2013-04-18 Thread abhinav narain
hi Guy, > What happens if you eliminate that (and any code paths that eliminating > that breaks)? > > That seems to be the biggest difference between your code and tcpdump's > code (both your program and tcpdump use pcap_loop() as their main loops). I turned off SIGPROCMASK stuff ... it did not

Re: [tcpdump-workers] tcpdump vs libpcap : CPU usage shooting high for two simultaneous captures on wireless monitor interfaces

2013-04-18 Thread Guy Harris
On Apr 17, 2013, at 8:03 PM, abhinav narain wrote: > The other fancy thing which I am doing is setting a SIGPROCMASK to capture > alarms > to get to a handler which writes into the file every x minute(and if the > table is full) What happens if you eliminate that (and any code paths that elim

Re: [tcpdump-workers] parent-child process, selectable file descriptor and pcap

2013-04-18 Thread Guy Harris
On Apr 17, 2013, at 7:10 PM, wen lui wrote: > I have a program, part of the source codes are: > >handle = pcap_open_live(dev, BUFSIZ, 0, 0, errbuf); >pcap_compile(handle, &fp, filter_exp, 0, mask) == -1 >pcap_setfilter(handle, &fp); >struct pcap_pkthdr pcap_heade