How do I make libpcap/pcap_loop non-blocking?

Question

I'm currently using libpcap to sniff traffic in promiscuous mode

int main() 
{
    // some stuff
    printf("Opening device: %s\n", devname.c_str());

    handle = pcap_open_live(devname.c_str(), 65536 , 1 , 0 , errbuf);

    if (handle == NULL)
    {
        fprintf(stderr, "Couldn't open device %s : %s..." , devname.c_str(), errbuf);
        return 1;
    }
    printf(" Done\n");

    pcap_loop(handle , -1 , process_packet , NULL);
    // here run a thread to do some stuff. however, pcap_loop is blocking
    return 0;
}

I'd like to add an external thread to do some other stuff. How do I change the code above to make it non-blocking?

I can try, but what if I wanted to do some other stuff after pcap_loop? — Bob, Jul 09 '15 at 00:31

score 4 · Accepted Answer · answered Jul 17 '15 at 18:40

When you use non-blocking mode on libpcap you have to use pcap_dispatch, but note, pcap_dispatch can work in blocking or in non-blocking mode, it depends how you set libpcap, to set libpcap to work in non-blocking you have use the function pcap_setnonblock:

int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);

The difference between blocking and non-blocking is not a loop that runs forever, but in blocking the function pcap_dispatch waits for a packet and only returns when this packet is received, however, in the non-blocking mode the function returns immediately and the callback must process the packet.

In "non-blocking" mode, an attempt to read from the capture descriptor with pcap_dispatch() will, if no packets are currently available to be read, return 0 immediately rather than blocking waiting for packets to arrive. pcap_loop() and pcap_next() will not work in "non-blocking" mode.

http://www.tcpdump.org/manpages/pcap_setnonblock.3pcap.html

score 0 · Answer 2 · answered Jul 09 '15 at 00:47

0

pcap_loop is meant to go on until all input ends. If you don't want that behavior, call pcap_dispatch in a loop instead. By definition pcap_loop will never return, its meant to always searching for more data.

answered Jul 09 '15 at 00:47

Gabe Sechan

90,003
9
87
127

thank you. for now I run the thread before pcap_loop. it seems to be working. – Bob Jul 09 '15 at 03:04

Gerhard · Answer 3 · 2016-09-27T08:01:28.037

0

I use pcap_next_ex It returns a result indicating if a packet was read. This way I manage the acquisition my own thread. See an example here. The read_timeout in pcap_open also affects this function.

edited Sep 27 '16 at 08:01

answered Sep 27 '16 at 07:56

Gerhard

6,850
8
51
81

How do I make libpcap/pcap_loop non-blocking?

3 Answers3