On Sun, Mar 17, 2002 at 05:06:59PM -0800, Guy Harris wrote: > On Sat, Mar 16, 2002 at 06:18:32PM -0800, Aaron Cheek wrote: > > In the Linux world, I can make tcpdump et al listen to > > the "any" interface, thanks (as far as I know) to the > > patches developed by S. Krahmer to libpcap. > > > > Does any OpenBSD-compatible version of libpcap support > > this behaviour? > > Not that I know of.
Note, though, that it might be possible to have applications open more than one networking device, and use "select()" or "poll()" to wait for input from any of them, and process the input with, say, a call to "pcap_dispatch()" if input is available. Unfortunately "select()"/"poll()" on BPF devices doesn't always work - the "select()"/"poll()" may block until the BPF device's buffer fills, with the timeout *not* waking it up. It might work on sufficiently recent versions of some BSDs. On those where it doesn't, it *might* be possible to use a timeout in "select()"/"poll()", and put the capture stream into non-blocking mode (using "pcap_setnonblock()" in libpcap 0.7 and later, or by directly setting O_NONBLOCK on the file descriptor if your libpcap doesn't have "pcap_setnonblock()"; note that there is no guarantee that, in future libpcap releases, directly setting O_NONBLOCK will work, so programs should always use "pcap_setnonblock()" if it's present), and, when the "select()"/"poll()" timeout goes off, try to read from all the BPF devices. I'm not sure that'd work in FreeBSD 4.4, for example (I haven't tried it, I'm just guessing based on a quick look at the code). It should work in older versions, and I think "select()"/"poll()" should just work without a timeout in 4.5 and later. I can't speak for NetBSD or OpenBSD, although I *suspect* "select()" or "poll()" would work without the timeout in recent versions of OpenBSD. Note that this doesn't help you with tcpdump, as it only opens one device. Note also that the libpcap capture format doesn't support having captures from multiple devices, with different link-layer types. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
