Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Delays in real-time packet capture

From: Richard van der Hoff <richardv@xxxxxxxxxxxxx>
Date: Mon, 09 Oct 2006 12:54:58 +0100
Sorry for taking a while to get back to this...

Guy Harris wrote:
Richard van der Hoff wrote:

The only concern with this would be that dumpcap would presumably then send a packet count after every packet - which might mean a significant quantity of data.

Every batch of packets, at least.

Some OSes support packet batching, so that a single read from the capture device can supply multiple packets; those OSes support a timeout, so that the read either waits for a full batch or for a timer to expire, so you don't wait indefinitely for a full batch.

...
Linux, however, doesn't support batching, at least not in PF_PACKET sockets.

So perhaps the ideal would be to use select() to timeout on OSes which support it (ie, Linux); batching on OSes which support that but not select() on a socket (SunOS, Digital/Tru64, WinPcap, etc?), and send an update for every packet on those that support neither (are there any?).

Or is this overcomplicated and we should just send an update every packet if the OS doesn't support batching?

Regards,

Richard


--
Richard van der Hoff <richardv@xxxxxxxxxxxxx>
Project Manager
Tel: +44 (0) 845 666 7778
http://www.mxtelecom.com