Usage of pcap_open_live argument to_ms

[Robert Lowe <Robert.H.Lowe () lawrence edu>]

Hi!

Regarding the to_ms argument to pcap_open_live, the pcap manpage says:

--

to_ms specifies the read timeout in milliseconds. The read timeout is
used to arrange that the read not necessarily return immediately when
a packet is seen, but that it wait for some amount of time to allow
more packets to arrive and to read multiple packets from the OS kernel
in one operation. Not all platforms support a read timeout; on
platforms that don't, the read timeout is ignored. A zero value for
to_ms, on platforms that support a read timeout, will cause a read to
wait forever to allow enough packets to arrive, with no timeout.

--

How does one "tune" this value?  Does using a zero value on platforms
that support a read timeout have performance implications?  What does
"enough packets" mean exactly?  Are packets queued for the callback
routine -- I'm using pcap_loop().  Also does pcap_loop() set errno if
it terminates abnormally?

TIA,
Robert


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.