RE: [Ethereal-dev] Too many pcap_open_live calls during capture loop

["Jacques, Olivier (OCBU-Test Infra)" <olivier.jacques@xxxxxx>]

Ulfl and all,

I tried to narrow this problem down, and I have some interesting findings:
- pcap_open_live is not called for each packet received, but for a fraction of them (around one third)
- It doesn't occur with tethereal
- I get the problem only if "Update list of packets in real time" is checked (auto scrolling doesn't seem to change anything)
- On top of winpcap 3.1 vanilla, I just added one trace that logs a line to c:\tmp\wpcap.log (diff attached). So that you can reproduce it, I attached the resulting wpcap.dll (this is winpcap 3.1)
- When capturing IP traffic, I get many, many "pcap-win32.c: pcap_open_live" (ethereal-gtk2.exe).

For some reason, if I put a breakpoint on all pcap_open_live occurrences in Ethereal, the debugger doesn't stop during traffic. I suspect this has to do with starting another thread for capturing.
Looking at the differences between tethereal and ethereal capture loops, I wasn't able to see how this could be caused.

I'm sure you can reproduce the issue - and now I think that the problem is on Ethereal's side (not winpcap) and that every Windows user has it.

Olivier. 

> -----Original Message-----
> From: ethereal-dev-bounces@xxxxxxxxxxxx 
> [mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of Ulf Lamping
> Sent: mercredi 22 février 2006 08:18
> To: Ethereal development
> Subject: Re: [Ethereal-dev] Too many pcap_open_live calls 
> during capture loop
> 
> Jacques, Olivier (OCBU-Test Infra) wrote:
> > It seems (hard to say for sure, as I generated traces to a 
> file / not 
> > a breakpoint), that the pcap_open_live is called for each 
> packet received.
> >   
> That's very strange and certainly not (directly?) caused by Ethereal.
> > Is there anything specific done by Ethereal with pcap/wpcap at the 
> > time a packet is received?
> >   
> No, Ethereal calls pcap_dispatch, so WinPcap will call 
> ld->packet_cb which is actually capture_loop_packet_cb for 
> each packet.
> 
> I'm pretty sure that Ethereal is calling pcap_open_live only 
> once for a whole capture run.
> > I'm not at the office currently, but I'll try to have a 
> further look 
> > at that next week.
> >   
> Are you *sure* that your trace message texts are correct (not 
> a cut and paste error)?
> 
> Regards, ULFL
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>

Attachment: wpcap.zip
Description: wpcap.zip

Attachment: wpcap_trace.diff
Description: wpcap_trace.diff