Bug #3

pcap_dispatch blocks on exit if no traffic is seen.

Added by Will Metcalf over 4 years ago. Updated over 2 years ago.

Status:ClosedStart date:11/10/2009
Priority:LowDue date:
Assignee:-% Done:

100%

Category:-Estimated time:0.50 hour
Target version:-

Description

If the engine is sent a signal to exit in pcap live mode, pcap_dispatch will block until a packet is received.

See the threads below. We can overcome this by setting the pcap
handle to non-blocking but cpu utilization increases a ton. Not that big of an issue but here are some threads explaining it and possible solutions.

http://www.mail-archive.com/tcpdump-workers@lists.tcpdump.org/msg02491.html
http://seclists.org/tcpdump/2009/q1/171

History

#1 Updated by Victor Julien over 4 years ago

The non blocking solution is probably not interesting for performance reasons. The other option is to look at pcap_breakloop but that needs to be called by the pcap thread(s) itself then. Low priority issue.

#2 Updated by Victor Julien over 4 years ago

  • Target version changed from 0.8.0 to TBD

#3 Updated by Eric Leblond over 2 years ago

I'm not able to reproduce it. Maybe we could close it ?

#4 Updated by Will Metcalf over 2 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

afaik this was a libpcap 0.9.x bug. closing.

#5 Updated by Victor Julien over 2 years ago

  • Assignee deleted (OISF Dev)
  • Target version deleted (TBD)

Also available in: Atom PDF