libpcap: which platforms support packet buffer timeout via pcap_set_timeout()?

1
votes

I'd like to have pcap_dispatch() timeout if no packets are received within a set period of time. Similar to this SO question.

In the pcap(3) manpage, it says that not all platforms support that:

Not all platforms support a packet buffer timeout; on platforms that don't, the packet buffer timeout is ignored. A zero value for the timeout, on platforms that support a packet buffer timeout, will cause a read to wait forever to allow enough packets to arrive, with no timeout. A negative value is invalid; the result of setting the timeout to a negative value is unpredictable.

And in this post, user862787 said that "Some OSes time out even if no packets have arrived, others don't"

It's considered platform-specific because it is, but it's not considered buggy (trust me, I'm the person who wrote that text in the man page) - the timeout is to keep pcap_dispatch() from waiting forever for a packet buffer to fill, not to keep it from waiting forever for any packets to arrive at all. Some OSes time out even if no packets have arrived, others don't. – user862787 Oct 19 '12 at 20:53

So how do I know which platforms support and which don't? I've searched and gone through the libpcap source but didn't find anything.

Specifically, what about Centos 8.1, kernel 4.18.0-147.el8.x86_64, libpcap 1.10 ?

1
tcpdumplibpcap

1 Answers

0
votes

On systems using the BPF capture mechanism - *BSD, macOS, Solaris 11, AIX - the timeout will occur even if no packets have arrived.

On most versions of most Linux distributions, it won't.

Don't depend on it doing so or not doing so; write your code not to depend on that.

I've searched and gone through the libpcap source but didn't find anything.

You need to look at the source for the capture mechanism libpcap uses on particular platforms, not at the libpcap source.