Bob Bob - 2 months ago 24
C++ Question

How do I make libpcap/pcap_loop non-blocking?

I'm currently using libpcap to sniff traffic in promiscuous mode

int main()
{
// some stuff
printf("Opening device: %s\n", devname.c_str());

handle = pcap_open_live(devname.c_str(), 65536 , 1 , 0 , errbuf);

if (handle == NULL)
{
fprintf(stderr, "Couldn't open device %s : %s..." , devname.c_str(), errbuf);
return 1;
}
printf(" Done\n");

pcap_loop(handle , -1 , process_packet , NULL);
// here run a thread to do some stuff. however, pcap_loop is blocking
return 0;
}


I'd like to add an external thread to do some other stuff. How do I change the code above to make it non-blocking?

Answer

When you use non-blocking mode on libpcap you have to use pcap_dispatch, but note, pcap_dispatch can work in blocking or in non-blocking mode, it depends how you set libpcap, to set libpcap to work in non-blocking you have use the function pcap_setnonblock:

int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);

The difference between blocking and non-blocking is not a loop that runs forever, but in blocking the function pcap_dispatch waits for a packet and only returns when this packet is received, however, in the non-blocking mode the function returns immediately and the callback must process the packet.

In "non-blocking" mode, an attempt to read from the capture descriptor with pcap_dispatch() will, if no packets are currently available to be read, return 0 immediately rather than blocking waiting for packets to arrive. pcap_loop() and pcap_next() will not work in "non-blocking" mode.

http://www.tcpdump.org/manpages/pcap_setnonblock.3pcap.html

Comments