[tcpdump-workers] What's the correct new API to request pcap_linux to not open an eventfd

Denis Ovsienko denis at ovsienko.info
Tue Jul 5 07:07:05 EDT 2022

On Fri, 1 Jul 2022 13:55:30 -0400
Bill Fenner via tcpdump-workers <tcpdump-workers at lists.tcpdump.org>

> If we set
> pcap_nonblock after pcap_create and before pcap_activate, we get -3 -
> which I don't get at all, unless, -3 means "you didn't activate the
> pcap yet". My naive reading of the Linux pcap_getnonblock code says
> it'll return the integer value of a bool, and I don't know how that
> can be -3.

Hello Bill.

The pcap_setnonblock(3PCAP) man page describes two functions:

int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);
int pcap_getnonblock(pcap_t *p, char *errbuf);

If your comments concern pcap_getnonblock(), what you describe is
consistent with the documented behaviour:

In pcap/pcap.h:

#define PCAP_ERROR_NOT_ACTIVATED        -3      /* the capture needs to
be activated */

In the man page:

       pcap_getnonblock()  returns  the  current ``non-blocking''
       state of the capture descriptor; it always  returns  0  on
       ``savefiles''.   If  called  on  a capture handle that has
       been created but not  activated,  PCAP_ERROR_NOT_ACTIVATED
       is returned.  If there is another error, PCAP_ERROR is re‐
       turned and errbuf is filled in with an  appropriate  error

Did you mean there is an issue with pcap_setnonblock()?

    Denis Ovsienko

More information about the tcpdump-workers mailing list