Wireshark-dev: [Wireshark-dev] realtime dumpcap capability
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: marty leisner <maleisner@xxxxxxxxx>
Date: Sun, 10 Mar 2019 14:35:10 -0400
Running on linux, I'm using two sharktap's across the lan/wan ports of a router.

I'm running dumpcap into pipes, and reading the pipes.

I want the packets being emitted to be close time between the ingress/egress packets -- what I'm seeing is a difference of up to
hundreds of milliseconds which is too long for my use.  (on a busy lan, it would be hundred of packets difference).

I've played with PIPE_READ_TIMEOUT and WRITER_THREAD_TIMEOUT and haven't gotten much improvement (some, not much)

Are there good tutorials for pulling packets out of the linux kernel (with or without libpcap) -- or is it UTSL?

marty