pcap_loop和pcap_dispatch的区别

Question

pcap_loop和pcap_dispatch之间的区别到底是什么？

Answer 1

手册对此进行了令人惊讶的描述(我是板着脸说的，我保证)。来自man pcap_loop

   pcap_loop() processes packets from a  live  capture  or  ``savefile''
   until  cnt  packets  are  processed,  the  end of the ``savefile'' is
   reached when reading from a ``savefile'', pcap_breakloop() is called,
   or  an  error  occurs.   It  does  not return when live read timeouts
   occur.  A value of -1 or 0 for cnt is equivalent to infinity, so that
   packets are processed until another ending condition occurs.

   pcap_dispatch() processes packets from a live capture or ``savefile''
   until cnt packets are processed, the end of the current bufferful  of
   packets  is reached when doing a live capture, the end of the ``save‐
   file'' is reached when reading from a ``savefile'',  pcap_breakloop()
   is  called, or an error occurs.  Thus, when doing a live capture, cnt
   is the maximum number of packets to process before returning, but  is
   not a minimum number; when reading a live capture, only one bufferful
   of packets is read at a time, so fewer than cnt packets may  be  pro‐
   cessed. A value of -1 or 0 for cnt causes all the packets received in
   one buffer to be processed when reading a live  capture,  and  causes
   all  the  packets  in the file to be processed when reading a ``save‐
   file''.

我知道您并不是真的想阅读和理解所有这些内容，所以让我们来分析一下。

两个函数都是

从实时捕获或“保存文件”中处理数据包，直到出现以下任何情况为止：“保存文件”的末尾是reached

• pcap_breakloop() is occurs

is

• is

• an error count

​

• 认为-1或0本质上意味着“处理无限数量的数据包”-也就是说，直到出现另一个结束条件。(建议使用-1以实现与旧版本的互操作性，稍后将在手册中介绍)

单独使用pcap_dispatch()

在执行实时捕获(换句话说，可以更频繁地返回，因为指定的计数不是最小计数)时，

• 也会在达到当前数据包缓冲区的末尾后返回