Project

General

Profile

Bug #3

pcap_dispatch blocks on exit if no traffic is seen.

Added by Will Metcalf over 11 years ago. Updated about 9 years ago.

Status:
Closed
Priority:
Low
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

If the engine is sent a signal to exit in pcap live mode, pcap_dispatch will block until a packet is received.

See the threads below. We can overcome this by setting the pcap
handle to non-blocking but cpu utilization increases a ton. Not that big of an issue but here are some threads explaining it and possible solutions.

http://www.mail-archive.com/tcpdump-workers@lists.tcpdump.org/msg02491.html
http://seclists.org/tcpdump/2009/q1/171

Also available in: Atom PDF