sending MAC packets --- again, and again

[Daniel Valencia]

Hello and thanks for your prompt answer...

I followed your (Jon Simola's) advice, so i defined
BUFSIZ as 2000, although my tutorial said it was
defined somewhere in the pcap headers, and added a
pcap_loop instead of the pcap_next.  I also modified
the program to only show packets that are sent from a
broadcast address and to a broadcast address (which is
how i'm sending my packets).

I can see almost all the packets I send.  The issue is
a little interesting, because I'd expect in a network
with almost no trafic for my packets to show up
immediately.  Actually, at startup my sniffer stalls
for a good minute and half, during which period some
of the packets I send will show up and some will not,
and after all the bunch is printed, it stalls again,
while I keep putting messages in the wire from the
other machine.  After some more 60 seconds have
passed, i see all of the messages appear all at once.

Is this normal pcap behaviour, or is it some
FreeBSD-specific behaviour, or is it just me?

Thank you again

- Daniel


--- Jon Simola <jsimola at gmail.com> wrote:
> On 5/20/05, Daniel Valencia <fetrovsky at yahoo.com>
> wrote:
> 
> > my sniffer just stalls and eventually will report
> a totally unrelated message.
> ...
> >         handle = pcap_open_live( "xl0", BUFSIZ, 1,
> 0, errbuf );
> 
> Uh, you're asking it to wait forever to see a
> packet. I don't see a
> #define in there for BUFSIZ, so you might be asking
> it to catch zero
> bytes. And what is the "totally unrelsated message"?
> 
> I'd try using pcap_loop() or friends so you can
> catch and examine more
> than a single packet.
> 
> And don't forget to call pcap_close() at the end,
> I'm not sure how
> polite pcap is about leaving dangling bpf devices.
> 
> -- 
> Jon Simola
> Systems Administrator
> ABC Communications
> 


		
Yahoo! Mail
Stay connected, organized, and protected. Take the tour:
http://tour.mail.yahoo.com/mailtour.html