[tcpdump-workers] TPACKET_V3 support added big packet delivery delay and/or affected timestamps

Guy Harris guy at alum.mit.edu
Fri Dec 5 06:34:57 EST 2014

On Dec 5, 2014, at 3:15 AM, Thomas Habets <thomas at habets.se> wrote:

> On 4 December 2014 at 20:01, Guy Harris <guy at alum.mit.edu> wrote:
>> If your program needs to have packets delivered as soon as they arrive, it should, if the version of libpcap with which it's being built has the pcap_set_immediate_mode() API
> Thanks. I switched to the pcap_create() API from pcap_open_live() (my
> code predates pcap_create()) and set immediate mode, and that did it.

I'd move the BIOCIMMEDIATE call into try_pcap_open_live(), and do it if

	1) BIOCIMMEDIATE is defined and

	2) either a) you don't have pcap_create() or b) you do but don't have pcap_set_immediate_mode()

as you don't have to use it on BPF systems that *do* have pcap_set_immediate_mode() as that call will do it for you (or, rather, will cause it to be done at pcap_activate() time).

More information about the tcpdump-workers mailing list