poll on BPF devices
poll on BPF devices
- Subject: poll on BPF devices
- From: "Nithin Raju" <email@hidden>
- Date: Tue, 18 Mar 2008 14:57:50 -0700
- Thread-topic: poll on BPF devices
Hello
all,
This question has
probably been addressed before and beaten to death, but I just could not get
something that would work for me, hence this post.
I have a
requirement where my application needs to sniff for raw packets on the wire
based on a filter. I figured from the various posts on the BSD/Apple mailing
lists that RAW sockets don't work the same way they do on Linux, hence the only
options were either - Divert sockets or BPF devices. I ruled out Divert sockets
since I don't want my application to mess with the firewall rules in a
persistent way. I was left with BPF devices, then I found out that
poll()/select() on BPF devices was broken. Poll returns a POLLNVAL on the device
instead of POLLIN.
My question is, is
there a workaround to make poll() return POLLIN as the event on a BPF device ?
Or is there some other event that would reliably tell me that, yes there's data
to read.
The other option I
was ready to explore was libpcap (which uses BPF internally, I believe).
I was
looking at the pcap_* APIs, and pcap_get_selectable_fd() says that it returns a
pollable/selectable fd. But, even this did not seem to be very useful. select() did
set the rfds structure for the descriptor, but read()
blocked. May be I should use pcap_dispatch() but, I want to do a synchronous read.
poll() again, returned a POLLNVAL on the fd returned by
pcap_get_selectable_fd(). So, I am not really sure whether libpcap helps me
either.
My OS is
Tiger
(10.4).
All suggestions
are appreciated.
thanks,
--
Nithin
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden