Actions
Bug #3
closedpcap_dispatch blocks on exit if no traffic is seen.
Status:
Closed
Priority:
Low
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
If the engine is sent a signal to exit in pcap live mode, pcap_dispatch will block until a packet is received.
See the threads below. We can overcome this by setting the pcap
handle to non-blocking but cpu utilization increases a ton. Not that big of an issue but here are some threads explaining it and possible solutions.
http://www.mail-archive.com/tcpdump-workers@lists.tcpdump.org/msg02491.html
http://seclists.org/tcpdump/2009/q1/171
Actions