tcpdump mailing list archives
Re: Linux mmap support and nonblocking mode
From: Guy Harris <guy () alum mit edu>
Date: Fri, 25 Jul 2014 01:29:51 -0700
On Jul 21, 2014, at 5:36 PM, Aaron Lehmann <aaronl () vitelus com> wrote:
I think I understand why this was happening, at least in the context of TPACKET_V3. The issue is similar to #335. The kernel closes blocks after a certain timeout, handing them over to userspace. This happens whether the blocks contain any packets or not.
Yes, that's ferociously bogus on the kernel's part.
My application uses libpcap in nonblocking mode with a separate event loop, and it didn't get notified of activity on the packet socket file descriptor when blocks expired.
As is that. I sent a mail to Chetan Loke about that in December 2013, but never got a response; perhaps I should poke linux-netdev or whatever mailing list is appropriate.
Eventually, a packet would pass the filter, but by this point, all blocks would be assigned to userspace, and the kernel would have nowhere to store it. Calling pcap_dispatch() from a timer seems to work around this by returning the blocks to the kernel. I'm now setting the pcap timeout to 50 ms (I wasn't setting it before), and running a timer every 50 ms that calls pcap_dispatch(). This looks more like a kernel issue than a libpcap issue to me, but I would appreciate a warning in the documentation that pcap_dispatch() needs to be called periodically, even if there's no activity on the selectable fd. Of course, if you can think of a way to work around this inside libpcap, that would be even better.
If the event loop isn't under libpcap's control, I'm not sure there's much we can do about that, so the best we can do is probably to suggest that the event loop needs a timer, and that, if the timer expires, all the pcap_t's should be checked (meaning they should all be in non-blocking mode). Some systems with BPF also require this, as the BPF timer in those systems isn't started by a select()/poll()/kqueue wait, so there's no timeout. (Even worse, due to a bug in Snow Leopard introduced by a fix to another bug, non-blocking mode doesn't work; fortunately, the timer does get started in Lion and later.) _______________________________________________ tcpdump-workers mailing list tcpdump-workers () lists tcpdump org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
Current thread:
- Linux mmap support and nonblocking mode Aaron Lehmann (Jul 23)
- Re: Linux mmap support and nonblocking mode Guy Harris (Jul 25)