tcpdump mailing list archives
Re: start pcap in two thread
From: Guy Harris <guy () alum mit edu>
Date: Fri, 6 Feb 2009 11:06:25 -0800
On Feb 6, 2009, at 7:24 AM, David Andrey wrote:
Can 2 threads (in the same process) start each one a sniffing session on the same interface, but with different filter. Is it safe and reliable ?
It should work *IF* each thread opens a separate pcap_t for the interface and sets its own filter for the interface.
I'm using Linux 2.6.27 and made some tests. It seems that one thread catch all the frames ?!
Did you open two different pcap_t's in the two threads, or are the two threads sharing the same pcap_t? Individual pcap_t's cannot be shared by a thread - and filters aren't per-thread.
If you opened two different pcap_t's, are you sure that the filter for the thread that's not capturing any frames will actually match any frame?
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- start pcap in two thread David Andrey (Feb 06)
- Re: start pcap in two thread Guy Harris (Feb 06)
- Re: start pcap in two thread Gianluca Varenni (Feb 06)
- Re: start pcap in two thread David Andrey (Feb 09)
- Re: start pcap in two thread Guy Harris (Feb 09)
- Re: start pcap in two thread Gianluca Varenni (Feb 06)
- Re: start pcap in two thread Guy Harris (Feb 06)