Re: bpf/pcap performance

[Michael Richardson <mcr () sandelman ottawa on ca>]

> > > > > "Darren" == Darren Reed <darrenr () reed wattle id au> writes:
    Darren> In some email I received from Guy Harris, sie wrote:
    >> On Sun, Apr 11, 2004 at 03:15:30AM +1000, Darren Reed wrote: >
    >> And there's also BPF_MAXBUFFERSIZE.  I see pcap_getbuff() as
    >> being > essential to getting code to work without trial and error
    >> by passing > different sizes to read() to find out what the right
    >> size to read > is, if you're not setting the size yourself.
    >> 
    >> But if you're using libpcap, you're not passing anything to
    >> read(), you're letting libpcap do that.

    Darren> Not necessarily.

    Darren> The interface exposed by libpcap is not conducive to good
    Darren> use by C++ applications - main culprit here is
    Darren> pcap_dispatch() but none of the others really help.  Unless
    Darren> all your classes are static classes (which kind of defeats
    Darren> the purpose, in my book.)

  Dareen, can you suggest a better interface? One that is friendly to
C++ without requiring that we drag in any C++ code?

--
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr () xelerance com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.