LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices

Reply
 
Search this Thread
Old 12-06-2006, 11:47 AM   #1
Rawjoe
LQ Newbie
 
Registered: May 2006
Posts: 13

Rep: Reputation: 0
Programming w/ pcap


I'm trying to program a multi-threaded program that uses pcap. In my pcap file I have my main thread that does something this:

Code:
while (capture_flag) {
  packet = pcap_next(handle, &header);
  //more code after this
}
which works great and all. Also, in the same file, I have a function called on by other threads to stop the capture:

Code:
void stop_capture(){
	capture_flag = 0;
	pcap_breakloop(handle);
}
Of course I have handle declared as a global variable.

Now, when I call stop_capture(), it seems to wait until pcap_next captures one more packet, and does not exit out of pcap_next right away. Does pcap_breakloop not actually break you out of pcap_next, and if so, how can I actually get pcap_next to stop waiting on a capture.

Thanks in advance,
Joe
 
Old 12-06-2006, 02:51 PM   #2
Rawjoe
LQ Newbie
 
Registered: May 2006
Posts: 13

Original Poster
Rep: Reputation: 0
To update, I read a few things on how you should use an signal, and call pcap_breakloop from the signal handler. But I still get it there, waiting for one last packet. Here is my updated code:

Code:
static sem_t pcap_sem;
static char filter_exp[100];
static unsigned char capture_packets;
pcap_t* handle;


static void sig15(int sig) {
	capture_packets = 0;
	pcap_breakloop(handle);
}

void pcap_cb (u_char *user, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data) {
	if (pkt_data) syslog(LOG_INFO, "Got packet: %d bytes captured:", pkt_header->caplen);
}

void * pcap_main(int *a) {

	char *dev, errbuf[PCAP_ERRBUF_SIZE];
	bpf_u_int32 mask, net;
	struct bpf_program fp;

	if (signal(15, sig15) == SIG_ERR) {
		perror("SIGNAL");
		syslog(LOG_INFO, "Error installing sig15 handler %m");
		exit(-1);
	}
	siginterrupt(15, 1);

	capture_packets = 0;

	if (sem_init(&pcap_sem, 0, 1) <0)
		syslog(LOG_INFO,"pcap_main: Failure to initialize semaphore\n");
	sem_wait(&pcap_sem);

	dev = pcap_lookupdev(errbuf);

	handle = pcap_open_live(dev, BUFSIZ, 1, 1000, errbuf);

	while (1) {
		sem_wait(&pcap_sem);

		if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
			syslog(LOG_INFO,"Couldn't parse filter %s: %s", filter_exp, pcap_geterr(handle));
			capture_packets = 0;
		} else if (pcap_setfilter(handle, &fp) == -1) {
			syslog(LOG_INFO,"Couldn't install filter %s: %s", filter_exp, pcap_geterr(handle));
			capture_packets = 0;
		}

		while (capture_packets > 0) {
			syslog(LOG_INFO, "Waiting to capture packet");
			pcap_loop(handle, -1, pcap_cb, NULL);
			syslog(LOG_INFO, "Done capturing packets");
		}

		pcap_freecode(&fp);
	}
}

void start_capture(unsigned long ccAddr, char* filter) {
	strcpy(filter_exp, filter);
	capture_packets = 0x0F;  //anything greater than 0
	sem_post(&pcap_sem);
}

void stop_capture(){
	raise(15);
}
 
Old 12-07-2006, 08:55 AM   #3
Rawjoe
LQ Newbie
 
Registered: May 2006
Posts: 13

Original Poster
Rep: Reputation: 0
Ok, so raise() was sending the signal to the parent thread, not this child thread handling pcap, so pcap loop was never being interrupted. I guess I should learn more about these signals and threads.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Question on PCAP filters kidskc Linux - Networking 1 08-17-2005 07:59 PM
Pcap Files OriDagan Linux - Networking 0 07-15-2005 04:20 AM
pcap library jagman Programming 1 04-27-2005 07:35 AM
pcap data extraction black_man Linux - Networking 1 08-28-2004 08:52 AM
Questions on pcap.h Traveler_Q Programming 2 02-25-2004 03:03 PM


All times are GMT -5. The time now is 12:48 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration