Guy Harris <guy <at> alum.mit.edu> writes: > > Good question. Do you know how could I verify the buffer > > they stay in? Is there > > some printout I could add before calling pcap_dispatch to see > > what's in the kernel buffer and what in the userland buffer? > > Yes, but you'd have to add it to libpcap. >
I made an interesting test. By collecting pcap_stats() after every call to pcap_dispatch and printing the pcap_stat values out, I could verify that the packets are received. E.g. if I filter for ICMP packets, by launching "ping" commands I can see "ps_recv" increase rapidly. Now, I don't know what "received" means (in userland? in kernel buffer?), but maybe you do :) Thanks, Marco - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
