Folks, I've been using 2.2.18 with a patched af_packet.c per some old libpcap mods (Alexey) on a dual cpu pentium III 450 (FDDI) system. Early on I had problems which surfaced whenever I ran an application that created child processes. I instrumented the libpcap library to sense this condition (that of a positive return from a poll system call, but a subsequent check of the ring finding no packet resulting in falling back into the poll [which unchecked created a rather tight infinite loop]). This only happened when an application created child processes (apparently the ring was passed on to one of the child processes that had no use for it). The 'tcpdump' application worked fine, never falling into the poll problem. The 'snort' application also worked fine. I've had good success using the memory mapped ring buffer approach to packet capture. Recently, I upgraded to 2.4.2, no patches, recompiled libpcap such that PACKET_RX_RING comes into play. Now, I'm seeing my old diagnostices in "pcap-linux.c:packet_ring_recv", that indicate that the poll system call thinks I will find a packet on the ring, but when I go to check the ring, there is nothing. Consequently, I downgraded to 2.2.18. Any help? Thanks, Phil - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org
