Bug #3: pcap_dispatch blocks on exit if no traffic is seen. - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #3

closed

pcap_dispatch blocks on exit if no traffic is seen.

Added by Will Metcalf over 14 years ago. Updated over 12 years ago.

Status:

Closed

Priority:

Low

Assignee:

Target version:

Affected Versions:

Effort:

Difficulty:

Label:

Description

If the engine is sent a signal to exit in pcap live mode, pcap_dispatch will block until a packet is received.

See the threads below. We can overcome this by setting the pcap
handle to non-blocking but cpu utilization increases a ton. Not that big of an issue but here are some threads explaining it and possible solutions.

http://www.mail-archive.com/tcpdump-workers@lists.tcpdump.org/msg02491.html
http://seclists.org/tcpdump/2009/q1/171

Actions

Copy link

Updated by Victor Julien over 14 years ago

The non blocking solution is probably not interesting for performance reasons. The other option is to look at pcap_breakloop but that needs to be called by the pcap thread(s) itself then. Low priority issue.

Actions

Copy link