pcap "packet" processing and storage

This is a discussion on pcap "packet" processing and storage within the C Programming forums, part of the General Programming Boards category; The pcap loop callback routine that the libcap library uses each time it captures a packet returns a pointer to ...

  1. #1
    Registered User
    Join Date
    Apr 2008
    Posts
    2

    pcap "packet" processing and storage

    The pcap loop callback routine that the libcap library uses each time it captures a packet returns a pointer to a packet that it has captured. I am a little confused as to the time period for which this "packet" memory is allocated. If I am performing calculations or even storage with each packet that pcap captures, will this memory location be overwritten while I am performing my tasks on the current packet location. It seems as though if I take too long in analyzing each packet that the data for the packet becomes corrupted or overwritten with the next packet received or I miss packets all together. Does pcap have any type of packet queuing system or is the programmer responsible for performing a memcpy on the packets returned and queuing them as soon as they are received in the callback? I am assuming under heavy network throughput the problem I am explaining above will only get worse as pcap has greater flow of packets to capture. How is pcap supposed to keep up with the large number of packets? or how am I supposed to keep up with the large number of packets received and still analyze each packet?

  2. #2
    and the hat of wrongness Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    32,484
    Since pcap is in essence tracking live data, I would say that it has either none or minimal ability to queue data internally. So I would suggest you do the minimum amount of work necessary in your callback before returning to pcap.

    The documentation should explain this.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.
    I support http://www.ukip.org/ as the first necessary step to a free Europe.

  3. #3
    Captain Crash brewbuck's Avatar
    Join Date
    Mar 2007
    Location
    Portland, OR
    Posts
    7,239
    Unless libpcap is multithreaded, I don't see how this is possible. By doing too much processing in the callback, you could potentially end up dropping packets due to the raw socket queue getting filled, but I don't think you could see data corruption in memory. I think you're probably causing that yourself somewhere.

    At any rate, just restructuring your code isn't going to solve the issue of not being able to keep up with packets. No matter how you do things, if the CPU isn't able to keep up with the raw packet flow, you're stuck.

  4. #4
    Registered User
    Join Date
    Apr 2008
    Posts
    2
    I'll just implement my own queue to store packets from the callback.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Is Kazaa being greedy?
    By minesweeper in forum A Brief History of Cprogramming.com
    Replies: 29
    Last Post: 11-05-2002, 03:39 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21