Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread Eloy Paris
On Tue, Apr 03, 2007 at 04:57:27PM +0100, roy hills wrote: [...] > What I find is that select() returns when there is any data received > on the network interface; not just data that will match the pcap > filter. In other words, just because select() returned indicating that > the pcap file descr

Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread Eloy Paris
On Tue, Apr 03, 2007 at 02:13:40PM -0700, Ury Segal wrote: > > I think you are seeing the same problem that I have described in my > >posting "Not receiving packets on Solaris, but no problems on Linux > >and BSD". > > > > I think what we both need is the Solaris/DLPI equivalent to the > > BSD/BPF

Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread Ury Segal
Hi! > I think you are seeing the same problem that I > have described in my posting "Not receiving >packets on Solaris, but no problems on Linux and > BSD". > > I think what we both need is the Solaris/DLPI > equivalent to the BSD/BPF BIOCIMMEDIATE ioctl. Do you happen to know what is the So

Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread roy hills
> I'll need to check on how select() is behaving, but it is working, and > I'm only calling pcap_dispatch() if select() indicates that the pcap > fd is readable. Yeah, that's what I do too. However, if I remember correctly, I found out that select() was not blocking (as it should) when there was

Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread Eloy Paris
Hello, On Tue, Apr 03, 2007 at 02:49:14PM +0100, roy hills wrote: > >I've also had problems with Solaris. In my opinion it's not the > >best platform for capturing packets in real-time. In Network Expect > >(http://www.netexpect.org) I am currently using the following code, > >which I borrowed fr

Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread roy hills
I've also had problems with Solaris. In my opinion it's not the best platform for capturing packets in real-time. In Network Expect (http://www.netexpect.org) I am currently using the following code, which I borrowed from another open source project (can't remember which): [snip] Great - that w

Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread Eloy Paris
Hi Roy, On Tue, Apr 03, 2007 at 09:51:16AM +0100, roy hills wrote: > >I am running a local pcap application on a Solaris host, capturing > >only packets going to and from a specific interface. Sometimes I see > >several packets coming in, in a row, and then several packets going > >out, in a row,

Re: [tcpdump-workers] Packet arrival order

2007-04-03 Thread roy hills
I am running a local pcap application on a Solaris host, capturing only packets going to and from a specific interface. Sometimes I see several packets coming in, in a row, and then several packets going out, in a row, from that interface. I think you are seeing the same problem that I have desc

[tcpdump-workers] Packet arrival order

2007-04-02 Thread Ury Segal
Hi, I am running a local pcap application on a Solaris host, capturing only packets going to and from a specific interface. Sometimes I see several packets coming in, in a row, and then several packets going out, in a row, from that interface. However, I know (from the content of the packets a