Re: When will a packet filter be ignored/unused?

[Eloy Paris <peloy () chapus net>]

On 03/17/10 18:45, Guy Harris wrote:

> On Mar 17, 2010, at 10:54 AM, Jim Lloyd wrote:
>
> > I've done some experimentation and determined that apparently I
> > must call pcap_activate before calling pcap_setfilter.
>
> Yes.
>
> > That is counter intuitive, so I wonder if it is by design or not.
>
> It may change at some point.  It is, however, currently a requirement
> (on all platforms).  It is also a requirement that the pcap_t be
> activated before you call pcap_compile(); lifting *that* restriction
> would require that we be able to get the link-layer type for the
> device before activating it, which may or may not be easy to do.
>
> I will update the documentation to indicate that the operations in
> question (pcap_datalink(), pcap_compile(), pcap_setfilter()) require
> that the pcap_t be activated *and* make what code changes are
> necessary to arrange that they fail on un-activated pcap_t's.-

Is this new in libpcap 1.1? If not then I guess my uses of libpcap 
through the years, on a handful of different platforms, have been 
working by magic since I've never called pcap_activate() in my life. I 
do see a man page for pcap_activate() in libpcap 1.0.0, though.

If applications using libpcap services have always been required to call 
pcap_activate() then I'd be curious to know why things have worked 
without doing so (at least for me). To be honest, the first time I heard 
about pcap_activate() was when Jim and Guy brought it up in this discussion.

Cheers,

Eloy Paris.-
netexpect.org
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.