Re: sending MAC packets --- again, and again

From: Daniel Valencia (fetrovsky_at_yahoo.com)
Date: 05/21/05

  • Next message: Charles Swiger: "Re: sending MAC packets --- again, and again" 
    Date: Sat, 21 May 2005 09:27:38 -0700 (PDT)
To: freebsd-net@freebsd.org

    Hello and thanks for your prompt answer...

    I followed your (Jon Simola's) advice, so i defined
    BUFSIZ as 2000, although my tutorial said it was
    defined somewhere in the pcap headers, and added a
    pcap_loop instead of the pcap_next. I also modified
    the program to only show packets that are sent from a
    broadcast address and to a broadcast address (which is
    how i'm sending my packets).

    I can see almost all the packets I send. The issue is
    a little interesting, because I'd expect in a network
    with almost no trafic for my packets to show up
    immediately. Actually, at startup my sniffer stalls
    for a good minute and half, during which period some
    of the packets I send will show up and some will not,
    and after all the bunch is printed, it stalls again,
    while I keep putting messages in the wire from the
    other machine. After some more 60 seconds have
    passed, i see all of the messages appear all at once.

    Is this normal pcap behaviour, or is it some
    FreeBSD-specific behaviour, or is it just me?

    Thank you again

    - Daniel

    --- Jon Simola <jsimola@gmail.com> wrote:
    > On 5/20/05, Daniel Valencia <fetrovsky@yahoo.com>
    > wrote:
    >
    > > my sniffer just stalls and eventually will report
    > a totally unrelated message.
    > ...
    > > handle = pcap_open_live( "xl0", BUFSIZ, 1,
    > 0, errbuf );
    >
    > Uh, you're asking it to wait forever to see a
    > packet. I don't see a
    > #define in there for BUFSIZ, so you might be asking
    > it to catch zero
    > bytes. And what is the "totally unrelsated message"?
    >
    > I'd try using pcap_loop() or friends so you can
    > catch and examine more
    > than a single packet.
    >
    > And don't forget to call pcap_close() at the end,
    > I'm not sure how
    > polite pcap is about leaving dangling bpf devices.
    >
    > --
    > Jon Simola
    > Systems Administrator
    > ABC Communications
    >

                    
    Yahoo! Mail
    Stay connected, organized, and protected. Take the tour:
    http://tour.mail.yahoo.com/mailtour.html

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Charles Swiger: "Re: sending MAC packets --- again, and again"

    Relevant Pages

    • Re: pcap and gig speeds.
      ... > results on a generic search of pcap), ... Linux doesn't behave better than FreeBSD regarding packet capture. ... its own computing rather than capturing packets. ... every X seconds, for real comparisons. ...
      (freebsd-stable)
    • libnet w/pcap for raw socks client / server
      ... I'm using libnet 1.1.1 and pcaplib 0.8.3. ... I'm attempting to use libnet and pcap together to write a raw sockets ... client for a client/server app, primarily so that I can gain explicit ... The libnet code to transmit packets exists solely in my pcap ...
      (comp.unix.programmer)
    • Re: [9fans] 9vx and native networking
      ... the pcap version didn't work very well for me. ... due to some linux misconfiguration. ... issue was something that is built into pcap to buffer packets for a ...
      (comp.os.plan9)
    • packet destination from pcap
      ... I'm sniffing packets with pcap but i need information about where the ... between packets going to a specified ip-address and those going from it. ...
      (freebsd-questions)
    • Re: memory mapped packet capturing - bpf replacement ?
      ... > still got the same number of copies as vanilla BPF. ... ng_hub does copy a packets. ... the benchmark works like this: ... run benchmark for pcap ...
      (freebsd-hackers)