How do I make libpcap/pcap_loop non-blocking?

Question

I'm currently using libpcap to sniff traffic in promiscuous mode

int main() 
{
    // some stuff
    printf("Opening device: %s\n", devname.c_str());

    handle = pcap_open_live(devname.c_str(), 65536 , 1 , 0 , errbuf);

    if (handle == NULL)
    {
        fprintf(stderr, "Couldn't open device %s : %s..." , devname.c_str(), errbuf);
        return 1;
    }
    printf(" Done\n");

    pcap_loop(handle , -1 , process_packet , NULL);
    // here run a thread to do some stuff. however, pcap_loop is blocking
    return 0;
}

I'd like to add an external thread to do some other stuff. How do I change the code above to make it non-blocking?

Answer 1

When you use non-blocking mode on libpcap you have to use pcap_dispatch, but note, pcap_dispatch can work in blocking or in non-blocking mode, it depends how you set libpcap, to set libpcap to work in non-blocking you have use the function pcap_setnonblock :

int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);

The difference between blocking and non-blocking is not a loop that runs forever, but in blocking the function pcap_dispatch waits for a packet and only returns when this packet is received, however, in the non-blocking mode the function returns immediately and the callback must process the packet.

In "non-blocking" mode, an attempt to read from the capture descriptor with pcap_dispatch() will, if no packets are currently available to be read, return 0 immediately rather than blocking waiting for packets to arrive. pcap_loop() and pcap_next() will not work in "non-blocking" mode.

http://www.tcpdump.org/manpages/pcap_setnonblock.3pcap.html

Answer 2

pcap_loop is meant to go on until all input ends. If you don't want that behavior, call pcap_dispatch in a loop instead. By definition pcap_loop will never return, its meant to always searching for more data.

Answer 3

I use pcap_next_ex It returns a result indicating if a packet was read. This way I manage the acquisition my own thread. See an example here . The read_timeout in pcap_open also affects this function.