Bug #3
closedpcap_dispatch blocks on exit if no traffic is seen.
Description
If the engine is sent a signal to exit in pcap live mode, pcap_dispatch will block until a packet is received.
See the threads below. We can overcome this by setting the pcap
handle to non-blocking but cpu utilization increases a ton. Not that big of an issue but here are some threads explaining it and possible solutions.
http://www.mail-archive.com/tcpdump-workers@lists.tcpdump.org/msg02491.html
http://seclists.org/tcpdump/2009/q1/171
Updated by Victor Julien about 15 years ago
The non blocking solution is probably not interesting for performance reasons. The other option is to look at pcap_breakloop but that needs to be called by the pcap thread(s) itself then. Low priority issue.
Updated by Victor Julien almost 15 years ago
- Target version changed from 0.8.0 to TBD
Updated by Eric Leblond over 13 years ago
I'm not able to reproduce it. Maybe we could close it ?
Updated by Will Metcalf over 13 years ago
- Status changed from New to Closed
- % Done changed from 0 to 100
afaik this was a libpcap 0.9.x bug. closing.
Updated by Victor Julien almost 13 years ago
- Assignee deleted (
OISF Dev) - Target version deleted (
TBD)