I'm a newbie on libpcap. Right now I am writing C program for capturing, modifying and injecting packets. I have three computers: A, B, C. A is sending ENIP packets to B with interval 10 ms. C is capturing packets sent by A and modifying the packets by: 1) incrementing the seq bit by 1; 2) changing the payload. For example, A is sending packets with seq = 1. C captures that packet, changes its seq bit to 2, changes the payload and injects it to the network. I hope computer B could receive this packet sent by C before receiving the packet with seq = 2 sent by A.
My c program is using pcap_loop to capture packets and pcap_inject to inject the packet. This process takes only several microseconds. However, B could not receive the packets sent by C before receiving packets sent by B. What I observed on computer B is that B receives several packets sent by A (e.g. with seq = 1,2,3,...30), then B receives several packets sent by C (with seq = 2,3,4,...,31), then packets sent by A (seq = 31,32,...90), then packets sent by C (seq = 32,...91)...
If I change the interval of A to 1 second, this problem doesn't exist...
I am thinking maybe there is some interrupt time for pcap_loop? Maybe pcap_loop captures packets for 0.5 seconds and then sends them to the network in a bunch? I am not sure...