[tcpdump-workers] What's the correct new API to request pcap_linux to not open an eventfd

Bill Fenner fenner at gmail.com
Tue Jul 5 09:28:14 EDT 2022

Hi Denis,

Thanks for pointing out the manpage update.  I had old man pages (my work
is being done in the context of the 1.10 release).  What confused me is the
asymmetry of the API.  If you call pcap_setnonblock() on an
un-activated socket, it sets a flag and doesn't return an error.  But
pcap_getnonblock() returns an error, so you can not check the value on an
un-activated socket.

This is not a flaw, necessarily, just confusing.

Now that I understand this flow (I did not realize there were two different
implementations of pcap_setnonblock(), because I was focused on
pcap-linux.c and not on the important stuff in pcap.c) I think it's
straightforward to defer the opening of the eventfd to pcap_activate(), so
that we can avoid opening the eventfd altogether in nonblock mode.  I'll
see if I can update my changes accordingly.  Thank you for pointing out the
extra detail that helped me to understand.


More information about the tcpdump-workers mailing list