Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Flush Packet to PCAP #372

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

jacob-baines
Copy link
Contributor

I was doing some work on a Raspberry Pi with libtins. Specifically, I was writing unique beacons to a pcap file. However, at the end of some runs the pcap would be empty. The PCAP man page states the following:

Packets written with pcap_dump() may be buffered, rather than being immediately written to the "savefile". Closing the pcap_dumper_t will cause all buffered-but-not-yet-written packets to be written to the ``savefile''.

Unfortunately, due to the nature of the RPI, the termination of my program is rarely clean. Meaning pcap_close() will almost certainly never be called. A simple work around is to call pcap_dump_flush() after every write to ensure, no matter what, that the packets get written to the pcap file instead of stored in memory indefinitely.

I was doing some work on a Raspberry Pi with libtins. Specifically, I was writing unique beacons to a pcap file. However, at the end of some runs the pcap would be empty. The [PCAP man page](https://www.tcpdump.org/manpages/pcap.3pcap.html) states the following:

> Packets written with pcap_dump() may be buffered, rather than being immediately written to the "savefile".
> Closing the pcap_dumper_t will cause all buffered-but-not-yet-written packets to be written to the ``savefile''.

Unfortunately, due to the nature of the RPI, the termination of my program is rarely clean. Meaning pcap_close() will almost certainly never be called. A simple work around is to call pcap_dump_flush() after every write to ensure, no matter what, that the packets get written to the pcap file instead of stored in memory indefinitely.
@mfontanini
Copy link
Owner

Sorry it took me a while to check this. I think ideally there would be a flush() function in PacketWriter. I don't think every user of the library should be forced to flush every time, as that can make writes slower. Can you instead add a separate function for that? I can do it otherwise.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants