[Winpcap-users] pcap sniffing and blocking issues

[Jeff Garrett]

Hi.
I have seen this topic in many forums and people have posted some opinions
about it, but I haven't been able to come up with a good design idea yet for
the tricky part.  Hoping someone can post their 2 cents, and maybe some
sample code.

So, I'm trying to create a simple cross-platform app to perform a few
commands (list the available interfaces, start sniffing on an interface, get
updated stats for an interface, stop sniffing on an interface).  User
provides input to which command they want to run, and I call the appropriate
function.

So far, I have main function working accepting user input and calling the
right function and I can display the interface list and stats from an
interface.  But its the sniffing and my process being blocked I am having
trouble with.  I need my StartSniffing( ) function to continue after calling
the pcap_loop (or pcap_dispatch or pcap_next_ex) to go back to the main
function for receiving user input (and to inform the user that the sniffing
has started) but still continue to receive packets and do whatever with them
(right now, just dump to a file).  Realistically, the next commands from the
user would be to get the updated stats from the interface handle every so
often, and then to close the handle and stop sniffing after so long (not a
time out, just user deciding to stop because they "have enough data now").
Or to start sniffing on another interface.

I have read forums where people said you have to create a new thread for
each interface you want to sniff on.  But also people that say to use
pcap_next_ex.  And others say to use signals (which I don't know about).
And some say to use pcap_breakloop while others have said to just kill the
separate thread.

Does anyone have any opinions on what I should use and why it would work in
this case?  Really looking forward to anyone's thoughts on this.

Thanks
Jeff
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110510/75be73fc/attachment.html>