Re: Multi process sniffing and dropped packets

[Michael Richardson <mcr () sandelman ottawa on ca>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> > > > > "computational" == computational complex-forthespam <computational_complex-forthespam () yahoo it> writes:
    computational> - every process executes an infinite loop in which
    computational> pcap_next() is called.  - every process executes a
    computational> pcap_loop() call.

  It's a good idea. Just fork and do work.

    computational> BUT..is pcap library able to manage safety multi
    computational> process (or maybe multi thread) calls with the same
    computational> pcap_t handle in each process ?

  pcap won't care. 
  It's your kernel that has to worry about this. Do any kernels permit
this kind of multi-threading? I don't think so.

  You could perhaps, do just load the filter and fork.
  You'd be sharing the same file descriptor, and if your kernel
returns one-packet-per-read (some mmap'ed interfaces do not!), then you
should get pretty good round-robin performance. Since you are fork()'ing
you have no thread issues.

- -- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr () xelerance com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Finger me for keys

iQEVAwUBQ8b8aICLcPvd0N1lAQL7yAf7Bno0lYGcUWzJMW9RBGnJS6JHPrX90tHh
PJYXo+n0Xs+MG+0O5sCP3vjOCc92e1Ce8XFSYABb2nOWjWGwupNPc1dmgKkbMoY+
w+1Mf5f6yLzhDn2vzRMXavR03EyS4Y9hi2nTfXhhOjrty8/bXlSMoYr+3bvX8+Im
YH/vINuJ3NOBLJ5kBhat0rr9oVOM+KAsJIP0mSVP7bRzXdvNit+gGONkEfL2YuEU
owFEq1fHgVACb9Si1yUOsU+Y9VX6INZL3wzJy+NTWplHQjHaVhf+KRqadH4xGz9w
xyQ6QODSACiPEohqajwwzcK3a3BXrrTKRwhrR0FFmm2W7okoaeoTWQ==
=MoZi
-----END PGP SIGNATURE-----
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.