(Reply redirected to [EMAIL PROTECTED], as that's where
"[EMAIL PROTECTED]" and "[EMAIL PROTECTED]" are now redirected.)
> since you open in non-promisc mode it might happen that
> theres no packet to capture and pcap_dispatch() never returns.
> Its blocked in a slow systemcall.
> You may use select() plus pcap_next() in this case.
...although, in that case, presumably there's nothing for his program to
do, if, in fact, it's trying to act as part of a TCP stack in userland.
(Note that in his "pcap_open_live()" call, he specified a "to_ms"
argument of 0, meaning he doesn't want a timeout.)
It may be that the filter expression is incorrect, or that there's some
other bug in the program. Without seeing the source to the program,
there's no way to tell what the problem is.
He should try running tcpdump or Ethereal or some other libpcap-based
packet sniffer program, using the exact same filter expression, with
promiscuous mode turned off, and see if any packets show up; if not, he
needs to figure out why (incorrect filter expression?), and, if so, he
needs to debug his program.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
