This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

pcap_next_ex never returns

0

This is probably more of a WinPcap question, but I call pcap_next_ex as follows:

int iRes = pcap_next_ex(pPcapDev, &pHdr, (const u_char**)&pubFrmBuf);

and it never returns.

But sending works:

pcap_sendpacket(pPcapDev, pubBuf, (int)ulLen);

Has anyone else seen this or know why pcap_next_ex fails to return an error at least.

Thanks, Brian

asked 11 Dec '12, 10:43

brwiese's gravatar image

brwiese
26111211
accept rate: 50%


One Answer:

0

This is probably more of a WinPcap question

Yes, it is. The best places to ask WinPcap questions would be:

I call pcap_next_ex as follows:

int iRes = pcap_next_ex(pPcapDev, &pHdr, (const u_char**)&pubFrmBuf);

and it never returns.

What pcap_open() or pcap_open_live() call are you making to get the pPcapDev handle? What arguments are you passing in that call? If you don't specify a timeout (i.e., you pass 0 as the timeout value), then, on many platforms - including, as far as I know, Windows - pcap_next() and pcap_next_ex() will return, and pcap_loop() and pcap_dispatch() will call the callback routine, only when the underlying capture mechanism's packet buffer fills up with packets, and, if the incoming packet rate (or the rate of incoming packets that pass the filter, if you've specified a filter with pcap_setfilter()) is low enough that the buffer takes a long time to fill up, that means that it could take an indefinitely long time for those routines to return or call the callback routine.

This is why there's a timeout argument - to allow packets to be buffered, so that there isn't a potentially-costly process wakeup for each packet received, but so that the packets will be delivered to your program after a relatively short period of time if the packets aren't arriving fast enough. Tcpdump sets the timeout to 1 second (1000 milliseconds), and dumpcap sets it to 1/4 second (250 milliseconds).

answered 11 Dec '12, 11:09

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%