what about a pcap_flush() function ?

[Alberto Ornaghi <alor () fastwebnet it>]

I'm thinking about a function, let's call it pcap_flush(pcap_t *pd),
that will zero the statistics and flush away any unread data from the
pcap file descriptor.

rationale:
if I open the filedescriptor with pcap_open_live, the received packets
will accumulate into the kernel buffer until a call to pcap_read() (or
similar) is performed.
if the read operation is not performed for a relative long time, the
kernel will start to drop packets. when eventually i start to read from
the buffer, the stats report a big number of dropped packets.
with the function I propose, i'll be able to flush the stats and all the
pending packets before starting to read from the filedescriptor.
think about a program that opens the fildesc with high privs and then
drop them and let the user configure some parameter from a GUI. when the
user chose to start to sniff, a relevant amount of time was elapsed
between pcap_open_live and pcap_read. in this situation the user will
get old packets (accumulated in the kernel buffer) and wrong statistics
(high value for dropped packets).

do you think it will be useful to have such function?  if so, i can
implement it and propose a diff against the current release.

i can simulate the flush of unread data within a loop, but the stats
cannot be reset. i think a pcap_reset_stats() will be useful.

any commets ?

bye

--

   --==> ALoR <==---------------------- -  -   -

 There are only 10 types of people in this world...
 Those who understand binary, and those who don't.


-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe