Re: [Libevent-users] how the difference of libevent version 1.4 and 2.0 influence libpcap events?

[liu wen <caonimagongling@xxxxxxxxx>]

I modifiesÂres = pcap_dispatch(handle, -1, collect_pkt, (u_char *)pkt_queue); to Âres = pcap_dispatch(handle, 1, process_pkt, NULL); and tries to process each received packet.

the whole source codes are in capture.tar.gz

I run the program on hostÂÂ192.168.0.106, and open a browser on another host to visit 192.168.0.106:8000

I use tcpdump with the same filter _expression_ as in the capture program to capture the packets (see attachment).

there are 16 packets altogether, but the program only capture 10 packets, that is 3 4 5 8 9 10 11 12 13 15

the on_capture event was triggered for 14 times, in order as below:

* 3 4 5 * 8 * 9 10 11 12 13 * 15

* means theÂpcap_dispatch return 0, for the other numbers(3 4 5 8 9 10 11 12 13 15) Âpcap_dispatch return 1

for the missing 16th packet, it is maybe that I end my program before I close the tcpdump process. so it means my capture program can't capture packet 1 2 6 7 14

why does this happen? why can't my program capture all the packets?Â

On Wed, Oct 14, 2015 at 12:27 AM, Mark Ellzey <mthomas@xxxxxxxxxx> wrote:

On Tue, Oct 13, 2015 at 3:20 PM, Mark Ellzey <mthomas@xxxxxxxxxx> wrote:

There shouldn't be a difference, technically that is. 1.x differs greatly though in functionality, but is backwards compat with 1.x. A few years ago I did a 2.x conversion for some very old code:Âhttps://github.com/ellzey/trafan/blob/master/trafan.cÂwith pcap.

and *many* many years ago I did this which never moved out to 2.x, completely 1.0. But it still works with old/new pcap and libevent as seen here:Â

https://strcpy.net/mark/dns_stuff/dns-sla/dnsm.cÂ

https://strcpy.net/mark/dns_stuff/dns_spoof_watch/dns_spoof_watch.c

But mind you, pcap_dispatch with -1 means you may be processing a ton of packets, all of which call your pcap callback. ÂÂ

All of this was done 9-10 years ago; so no mocking! Â(though it has been ripped and used for profit by certain individuals today, which I find amusing since it's such horrible code)

Attachment: port_8000.pcap
Description: application/vnd.tcpdump.pcap

Attachment: capture.tar.gz
Description: GNU Zip compressed data