On Jul 21, 2014, at 5:36 PM, Aaron Lehmann <aar...@vitelus.com> wrote:
> I think I understand why this was happening, at least in the context of > TPACKET_V3. The issue is similar to #335. The kernel closes blocks after > a certain timeout, handing them over to userspace. This happens whether > the blocks contain any packets or not. Yes, that's ferociously bogus on the kernel's part. > My application uses libpcap in > nonblocking mode with a separate event loop, and it didn't get notified > of activity on the packet socket file descriptor when blocks expired. As is that. I sent a mail to Chetan Loke about that in December 2013, but never got a response; perhaps I should poke linux-netdev or whatever mailing list is appropriate. > Eventually, a packet would pass the filter, but by this point, all > blocks would be assigned to userspace, and the kernel would have nowhere > to store it. > > Calling pcap_dispatch() from a timer seems to work around this by > returning the blocks to the kernel. I'm now setting the pcap timeout to > 50 ms (I wasn't setting it before), and running a timer every 50 ms that > calls pcap_dispatch(). > > This looks more like a kernel issue than a libpcap issue to me, but I > would appreciate a warning in the documentation that pcap_dispatch() > needs to be called periodically, even if there's no activity on the > selectable fd. Of course, if you can think of a way to work around this > inside libpcap, that would be even better. If the event loop isn't under libpcap's control, I'm not sure there's much we can do about that, so the best we can do is probably to suggest that the event loop needs a timer, and that, if the timer expires, all the pcap_t's should be checked (meaning they should all be in non-blocking mode). Some systems with BPF also require this, as the BPF timer in those systems isn't started by a select()/poll()/kqueue wait, so there's no timeout. (Even worse, due to a bug in Snow Leopard introduced by a fix to another bug, non-blocking mode doesn't work; fortunately, the timer does get started in Lion and later.) _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
