Re: start pcap in two thread

["David Andrey" <David.Andrey () netmodule com>]

Hi,

Thanks for help !

I open two different pcap_t's and become two different handles. The
filter are different, but with low differences ( AND operation on 1
byte).

@Guy
You say that "filters aren't per-thread" ... does it mean that the
second filter "delete" the first one ?

@Gianluca
"that function is not thread safe" ... do you mean a special one or all
functions of pcap ?

cu
David

> On Feb 6, 2009, at 7:24 AM, David Andrey wrote:
>
> > Can 2 threads (in the same process)  start each one a sniffing
session
> > on the same interface, but with different filter. Is it safe and
> > reliable ?
>
> It should work *IF* each thread opens a separate pcap_t for the
interface 
> and sets its own filter for the interface.
>
> > I'm using Linux 2.6.27 and made some tests. It seems that one thread
> > catch all the frames ?!
>
> Did you open two different pcap_t's in the two threads, or are the two

> threads sharing the same pcap_t?  Individual pcap_t's cannot be shared
by 
> a thread - and filters aren't per-thread.
>
> If you opened two different pcap_t's, are you sure that the filter for

> the thread that's not capturing any frames will actually match any
frame?

Also, be careful with pcap_compile. Unless something changed in the
latest 
versions of libpcap, that function is not thread safe, as it uses some 
global variables.

Have a nice day
GV

> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe. 

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.