4

I have a question, Imagine I have a thread which captures packets and process them itself.

With pcap_next_ex: I would use a loop and I would process the packets in each interaction, suppose I call Sleep(200) to simulate the stuff. With pcap_next_ex I would arrive a moment when I would lose packets.

With pcap_loop: I would use a callback to a packet handler for each packet incoming it would work like an event. In the packet handler I would treat the packets and suppose I call Sleep(200) to simulate the stuff. Would I lose packets?.

KaxperdayTrolling
  • 63
  • 9

1 Answers1

7

Yes.

pcap_next_ex and pcap_loop call the same internal function that reads a packet from the ring buffer. The difference is only that the former return the packet but the latter calls a callback with the packet.

pcap_loop calls the callback in the same thread as one called the pcap_loop, and waits for the callback to complete its task before reading the next packet. So, if the callback takes a long time, the pcap_loop cannot read packets enough frequently, which results in more possibility to lose packets.

kaitoy
  • 1,545
  • 9
  • 16
  • I would like that you would see a code I have which generates me problems doing a NAT with winpcap to a proxy local server. Im new in the community I would like to give you a PM. Regards. – KaxperdayTrolling Dec 20 '16 at 11:12
  • Ok. My contact is kaitoy@pcap4j.org – kaitoy Dec 20 '16 at 16:24
  • Thank you for your contact, I will write you my question as soon as I have time to create it, maybe I publish it in stackoverflow, I will keep you informed regards :) – KaxperdayTrolling Dec 21 '16 at 12:20