[tcpdump-workers] Multiple interface listening modification

Guy Harris guy at alum.mit.edu
Thu Jun 4 12:38:01 EDT 2015

On Jun 4, 2015, at 12:37 AM, Michal Sekletar <msekleta at redhat.com> wrote:

> Can't you just pcap_open more interfaces and for each pcap_t* you get call pcap_fileno which will return back file descriptor for that capture. Then you can use select/epoll to multiplex on those descriptors.

Or, in newer versions of libpcap, call pcap_get_selectable_fd(), which, for devices on which you can capture but on which you *can't* use select()/poll()/epoll()/kqueues, returns -1.  (Yes, they do exist; the DAG card drivers don't support it.)

BTW, that's also one problem with having a single pcap_t refer to multiple devices - a lot of code out there expects a single descriptor on which it can do select()/poll()/epoll()/kqueues, and you can't do that if a single pcap_t refers to multiple devices.

More information about the tcpdump-workers mailing list