Re: Should applications close pcap_get_selectable_fd()?

[Guy Harris <gharris () sonic net>]

On Aug 13, 2026, at 4:22 PM, Mark Delany <fzx () xray emu st> wrote:

> This is probably more a documentation clarification than anything else as a light troll
> through the archives suggests the answer...
>
> pcap_fileno(3) is fairly explicit about suggesting that the returned fd is the same one as
> that used internally by pcap, however pcap_get_selectable_fd(3) is much less forthcoming
> on the matter.
>
> My naive reading is that pcap_get_selectable_fd() returns a unique fd for my own purposes
> and that I should close it when I'm done,

The documentation needs to be changed to make it clearer that it should *not* be closed, because it could be, but is 
not guaranteed to be, the same file descriptor as the one used for the capture mechanism. (Some capture mechanism might 
require separate readable and selectable FDs. Npcap requires the Windows equivalent - a HANDLE on which to do reads, 
writes, and DeviceIoControl()s, and another HANDLE representing an event that can be waited on.)

Regardless of what it happens to be, it gets closed by pcap_close() (if it doesn't get closed, that's a bug in the 
code).

Thanks for catching this.

> In either case, I suggest that both manpages be explicit about closing responsibilities
> along the lines of "the returned file descriptor is closed by pcap_close()" or perhaps
> being even more explicit about what an application can safely do with the file descriptor
> without stomping on pcap.

It should probably just say "don't do anything with this descriptor other than handing it to 
select()/poll()/epoll()/some kqueue/whatever mechanism your OS provides for blocking until reading or injecting packets 
can be done without blocking (or failing if non-blocking mode is on)", or a more formal equivalent thereof, perhaps 
clarify that this means "don't read, don't write, don't ioctl, don't close".
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s