Re: buffering packets with libpcap 1.0.0

[Virgil Mihailovici <virgilm () gmail com>]

Thanks a lot for your reply. I understand the fact that I am going to  
consume kernel memory to buffer packets, but can I keep the buffer in  
use and the let the app free it? Like set the status to  
TP_STATUS_KERNEL when app is done with it? Would that work? Is there a  
way to do that (get a hold of the ring buffer pointer)?

Thanks again,
Virgil



On Oct 23, 2009, at 6:50 PM, Guy Harris <guy () alum mit edu> wrote:

> On Oct 23, 2009, at 5:09 PM, Virgil Mihailovici wrote:
>
> > I have a couple of questions:
> > 1. I am trying to change the size of the ring buffer allocated by  
> > pcap, it
> > seems that I have to use pcap_set_buffer_size to do that. The  
> > question is,
> > can I call this as a user,
>
> You can have your application call it in between calling pcap_create 
> () and pcap_activate().
>
> > 2. In order to avoid copies, I am trying to "hold on" to the packets
> > returned (not return them back to the ring). Is there any way to  
> > accomplish
> > this?
>
> No.  The ring shares memory between kernel and userland, and it's  
> not designed to allow an arbitrary amount of (wired-down) memory  
> (consuming kernel address space) to exist.
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.