Ask Your Question
0

pcap_dispatch hangs when interface down [closed]

asked 2019-03-29 01:07:56 +0000

Danny gravatar image

After updating to libpcap 1.9, the behavior of one of our programs seems to have changed.

A small program that sniffs traffic for a few seconds now hangs on poll() when called from pcap_dispatch when the link is down.

READ_TIMEOUT_MSEC is 50ms but it pcap_dispatch never returns... Is there another time out I can set or perhaps a setting to ignore everything if the link is down?

The connection is opened with:

pcap_open_live(device, SNAPLEN, promiscuousFlag, READ_TIMEOUT_MSEC, eBuf);

Followed later by:

numPktsToRead = 1
while (1)
{
    pcap_dispatch(mpCapture, numPktsToRead, processPacket, 0);

    gettimeofday(&tv2, 0);
    usecElapsed = (tv2.tv_sec-tv1.tv_sec)*1000000 + tv2.tv_usec - tv1.tv_usec;
    if (usecElapsed > 50000)
        break;
}

A backtrace of the hanged process shows:

(gdb) info threads
Id   Target Id         Frame
* 1    Thread 0xb751b6d0 (LWP 31625) "DvIPScanTraffic" 0xb7721e91 in __kernel_vsyscall ()
(gdb) bt
#0  0xb7721e91 in __kernel_vsyscall ()
#1  0x44832c1b in poll () from /lib/libc.so.6
#2  0xb76ceac2 in pcap_wait_for_frames_mmap (handle=0x9ef4630) at ./pcap-linux.c:4827
#3  0xb76cf0c1 in pcap_read_linux_mmap_v3 (handle=0x9ef4630, max_packets=1,
    callback=0x804af1a <DvIPScanTraffic::processPacket(unsigned char*, pcap_pkthdr const*, unsigned char const*)>, user=0x0)
    at ./pcap-linux.c:5326
#4  0xb76d4683 in pcap_dispatch (p=0x9ef4630, cnt=1,
    callback=0x804af1a <DvIPScanTraffic::processPacket(unsigned char*, pcap_pkthdr const*, unsigned char const*)>, user=0x0)
    at ./pcap.c:2565
edit retag flag offensive reopen merge delete

Closed for the following reason question is off-topic or not relevant by Guy Harris
close date 2019-03-29 02:30:14.661980

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-03-29 01:45:58 +0000

Guy Harris gravatar image

This isn't a Wireshark issue, and should be reported on the libpcap site on GitHub.

edit flag offensive delete link more

Question Tools

1 follower

Stats

Asked: 2019-03-29 01:07:56 +0000

Seen: 327 times

Last updated: Mar 29 '19