jbittel / httpry

HTTP logging and information retrieval tool

Home Page:dumpsterventures.com/jason/httpry

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Timeout to pcap_open_live() shouldn't be zero

guyharris opened this issue · comments

In prepare_capture(), pcap_open_live() is called with the third argument, which is the timeout, being 0.

The pcap man page says:

   read timeout
          If, when capturing,  packets  are  delivered  as  soon  as  they
          arrive,  the  application capturing the packets will be woken up
          for each packet as it arrives, and might have  to  make  one  or
          more calls to the operating system to fetch each packet.

          If,  instead,  packets are not delivered as soon as they arrive,
          but are delivered after a short delay (called a "read timeout"),
          more  than  one packet can be accumulated before the packets are
          delivered, so that a single wakeup would be  done  for  multiple
          packets,  and  each  set  of  calls made to the operating system
          would supply multiple packets,  rather  than  a  single  packet.
          This reduces the per-packet CPU overhead if packets are arriving
          at a high rate, increasing the number of packets per second that
          can be captured.

          The  read  timeout is required so that an application won't wait
          for the operating system's capture  buffer  to  fill  up  before
          packets are delivered; if packets are arriving slowly, that wait
          could take an arbitrarily long period of time.

          Not all platforms support a  read  timeout;  on  platforms  that
          don't,  the read timeout is ignored.  A zero value for the time-
          out, on platforms that support a read timeout, will cause a read
          to wait forever to allow enough packets to arrive, with no time-
          out.

This means that on several platforms, including all the BSDs and OS X, httpry will not see any packets until enough packets arrive to fill BPF's buffer.

A non-zero value should be specified here; the value should probably be between 1 and 1000.

I'm assuming you're using the latest released version, which currently does use 0. However, the development version has this timeout value set to 1000. Of course, this means I need to stop procrastinating and release a new version...

Thanks!

Earlier today I released version 0.1.8 which includes this change. Hope that helps!