Re: [tcpdump-workers] start pcap in two thread

2009-02-09 Thread Guy Harris
On Feb 9, 2009, at 8:54 AM, David Andrey wrote: I open two different pcap_t's and become two different handles. The filter are different, but with low differences ( AND operation on 1 byte). @Guy You say that "filters aren't per-thread" ... does it mean that the second filter "delete" the firs

Re: [tcpdump-workers] start pcap in two thread

2009-02-09 Thread David Andrey
Hi, Thanks for help ! I open two different pcap_t's and become two different handles. The filter are different, but with low differences ( AND operation on 1 byte). @Guy You say that "filters aren't per-thread" ... does it mean that the second filter "delete" the first one ? @Gianluca "that fun

Re: [tcpdump-workers] start pcap in two thread

2009-02-06 Thread Gianluca Varenni
- Original Message - From: "Guy Harris" To: Sent: Friday, February 06, 2009 11:06 AM Subject: Re: [tcpdump-workers] start pcap in two thread On Feb 6, 2009, at 7:24 AM, David Andrey wrote: Can 2 threads (in the same process) start each one a sniffing session o

Re: [tcpdump-workers] start pcap in two thread

2009-02-06 Thread Guy Harris
On Feb 6, 2009, at 7:24 AM, David Andrey wrote: Can 2 threads (in the same process) start each one a sniffing session on the same interface, but with different filter. Is it safe and reliable ? It should work *IF* each thread opens a separate pcap_t for the interface and sets its own filte

[tcpdump-workers] start pcap in two thread

2009-02-06 Thread David Andrey
Hi all, Can 2 threads (in the same process) start each one a sniffing session on the same interface, but with different filter. Is it safe and reliable ? I'm using Linux 2.6.27 and made some tests. It seems that one thread catch all the frames ?! Is it possible the compile libpcap for this u