Sorry for taking a while to get back to this...
Guy Harris wrote:
Richard van der Hoff wrote:
The only concern with this would be that dumpcap would presumably then
send a packet count after every packet - which might mean a significant
quantity of data.
Every batch of packets, at least.
Some OSes support packet batching, so that a single read from the
capture device can supply multiple packets; those OSes support a
timeout, so that the read either waits for a full batch or for a timer
to expire, so you don't wait indefinitely for a full batch.
...
Linux, however, doesn't support batching, at least not in PF_PACKET sockets.
So perhaps the ideal would be to use select() to timeout on OSes which
support it (ie, Linux); batching on OSes which support that but not
select() on a socket (SunOS, Digital/Tru64, WinPcap, etc?), and send an
update for every packet on those that support neither (are there any?).
Or is this overcomplicated and we should just send an update every
packet if the OS doesn't support batching?
Regards,
Richard
--
Richard van der Hoff <richardv@xxxxxxxxxxxxx>
Project Manager
Tel: +44 (0) 845 666 7778
http://www.mxtelecom.com