Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread Guy Harris
On Dec 11, 2011, at 4:10 PM, abhinav narain wrote: >> It sniffs for beacons by using bpf filter and keeps a per AP record of >>> packet count etc in a table. >> >> So if that's all you're doing, you presumably don't have your own buffer >> for packets; when you say "I already have 15% RAM being

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread Gianluca Varenni
When you talk about 15% RAM, do you actually mean working set or virtual address space? Which version of linux are you using? Regarding 802.11a/b/g/n, you cannot rely much on the radiotap header of a beacon frame. The radiotap header will only tell you which band was the packet transmitted on (

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread abhinav narain
> It sniffs for beacons by using bpf filter and keeps a per AP record of > > packet count etc in a table. > > So if that's all you're doing, you presumably don't have your own buffer > for packets; when you say "I already have 15% RAM being eaten by the > program, so I can't actually increase the b

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread Guy Harris
On Dec 11, 2011, at 2:42 PM, abhinav narain wrote: > It sniffs for beacons by using bpf filter and keeps a per AP record of > packet count etc in a table. So if that's all you're doing, you presumably don't have your own buffer for packets; when you say "I already have 15% RAM being eaten by th

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread abhinav narain
It sniffs for beacons by using bpf filter and keeps a per AP record of packet count etc in a table. Is poll() better than select ? I can only see A,B,G in beacons in tcpdump code, reading the radiotap header.. How can I infer an AP is N ? On Sun, Dec 11, 2011 at 2:35 PM, Guy Harris wrote: > >

Re: [tcpdump-workers] [PATCH] Improvement of behaviour when -s 0 is used

2011-12-11 Thread Guy Harris
On Oct 14, 2011, at 2:51 PM, Magnus Gille wrote: > I came across an issue with tcpdump where the linux kernel couldn't allocate > memory properly when we ran tcpdump -s 0 on one of our boxes. Tcpdump sets > snaplen to 65535 if -s 0 is provided and this became a problem for us, to > get around thi

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread Guy Harris
On Dec 11, 2011, at 11:17 AM, abhinav narain wrote: >> What is "it"? Your program? Or just *some* program? >> > Its the return statement of perror. Presumably you were calling perror() because some call returned -1; what call was that? If something keeps returning -1 because, for example, i

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread abhinav narain
RETURN VALUES > Select() returns the number of ready descriptors that are contained in > the descriptor sets, or -1 if an error occurred. If the time limit > expires, select() returns 0. If select() returns with an error, > includ- > ing one due to an interrupted call, the descrip

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread Guy Harris
On Dec 11, 2011, at 8:36 AM, abhinav narain wrote: > the return value of error is -1, > EINTR is 4. For many UN*X APIs, "the return value" and "the error" are not the same; "the return value" on an error is -1, and "the error" is in the variable "errno". The select() man page on my system (not

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread abhinav narain
I just ignored that case of return value -1 : and continued. It works now. The memory usage for two captures is 15%. I think I din't gain much using select() ! Abhinav On Sun, Dec 11, 2011 at 12:09 PM, wrote: > -[ Sun, Dec 11, 2011 at 11:36:14AM -0500, abhinav narain ] > > the return value

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread rixed
-[ Sun, Dec 11, 2011 at 11:36:14AM -0500, abhinav narain ] > the return value of error is -1, > EINTR is 4. errno is EINTR. If select returns -1, check for errno. If errno == EINTR, just retry. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread abhinav narain
the return value of error is -1, EINTR is 4. Also, it keeps printing ": Resource temporarily unavailable" though I don't have any error statement to be printed. This is increasing CPU usage Abhinav On Sun, Dec 11, 2011 at 7:48 AM, wrote: > I did not remember what select() uses to return the re

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread rixed
I did not remember what select() uses to return the readable file descriptors, but I do remember that any select can be interrupted while still waiting, and that the error is then EINTR, so you have to catch this particular error and ignore it (ie. merely loop on it). Googling for "non-restartable

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread abhinav narain
I used the FD_IFSET() way to fnd out the descriptor. I have an issue, For few time dispatch works fine, but after I write the stats to a file, and the loop returns to phy0, the programs quits with switch condition of -1. I don't see why ? I have the pcap{0,1} to non blocking. But this does not wo

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-11 Thread Guy Harris
On Dec 10, 2011, at 11:58 PM, Cedric Cellier wrote: >> I got it to work. > (...) >>> default: /* We got traffic */ >>> pcap_dispatch(pcap0,-1, (void *) packet_callback, NULL); >>> pcap_dispatch(pcap1,-1, (void *) packet_callback2, NULL); > > So that other may benefit from it in the fut