----- Original Message -----
From: "Guy Harris" <g...@alum.mit.edu>
To: <tcpdump-workers@lists.tcpdump.org>
Sent: Friday, February 06, 2009 11:06 AM
Subject: Re: [tcpdump-workers] start pcap in two thread
On Feb 6, 2009, at 7:24 AM, David Andrey wrote:
Can 2 threads (in the same process) start each one a sniffing session
on the same interface, but with different filter. Is it safe and
reliable ?
It should work *IF* each thread opens a separate pcap_t for the interface
and sets its own filter for the interface.
I'm using Linux 2.6.27 and made some tests. It seems that one thread
catch all the frames ?!
Did you open two different pcap_t's in the two threads, or are the two
threads sharing the same pcap_t? Individual pcap_t's cannot be shared by
a thread - and filters aren't per-thread.
If you opened two different pcap_t's, are you sure that the filter for
the thread that's not capturing any frames will actually match any frame?
Also, be careful with pcap_compile. Unless something changed in the latest
versions of libpcap, that function is not thread safe, as it uses some
global variables.
Have a nice day
GV
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.