> It was great for you to roll out 1.3 to fix the segfault on set_filter() but
> I can't actually get 1.3 to install (it fails the testsuite):
>
> 0: Failed to load library:
>
/home/jnh/.monger/Public_Network_Pcap-1.3/plib/modules/Public.pmod/Network.pmod/___Pcap.so:
> undefined symbol: pcap_dispatch
Hmm.... the test only checks to see if the module can be loaded. Anyone
know if pcap_dispatch is available only in certain versions? If it is, I
could make it conditionally available. It could, though, be a problem with
linking on your machine.
> I'm glad the module is there, but it does seem a little rough around the
> edges. Direct suggestions I have would be:
Yes, it's not changed in the 4 or 5 years since I wrote it.
>
> * change open_offline() to take a Stdio.File instead of a string
> path (meaning you could hand it a Pipe() or a network stream or
> whatever.
It's important to understand that some of the behavior is defined by the
pcap library. This, for example, is only available if your library has
pcap_fopen_offline, and would be tricky to implement well because there
isn't necessarily a fd available in a Stdio.File object.
> * lookup_dev() throws an error on my machine.
What sort of error? I've found that that function is a little flakey in
general.
> * using nbio uses lots of CPU
Not sure I understand... there isn't an NBIO interface, is there? I
assume that your question is really a matter of having a loop that's
constantly running the capture call. I'm not sure that there's a way to
know when a capture call will return a packet (uniformly, anyway).
In theory, the capture descriptor could be hooked to select/poll and then
run in the backend, but that would be a major undertaking.
> * it doesn't tell you what sort of interface (and thus what sort of
> frames) you are using. eg tunnels will give you raw IP packets,
> ethernet will give you ethernet frames.
That, I think is easily doable: pcap_datalink() seems to provide this
information.
I will also add that I think some of this functionality is new in libpcap
since I originally wrote the module, so I don't automatically add new
features I'm not using. Therefore, feature requests are the best way to
see that your needs are met. :)
Bill
|