Subject: Re: Question about libpcap
To: Gerald Lee <>
From: David Maxwell <>
List: tech-net
Date: 07/19/2007 22:46:42
On Thu, Jul 19, 2007 at 07:14:44PM -0700, Gerald Lee wrote:
> 	We have a unique situation.  An engineer want to use libpcap to
> create compile a packet filter.  However, he wants to use it purely in
> memory.  The problem comes in that the application is threaded, and one
> of the other threads is blocked on stdin.  This causes the parser to
> attempt to get more input from stdin.  He tracked it down to the state

When you say 'the parser' - do you mean the bpf lex/yacc machine?

> of yyin, and would just as soon directly manipulate it.  Others of us
> are discouraging this approach.
> 	However, I need to give him either 1) the appropriate
> incantations, or 2) a new interface (or variation on the current theme).
> We've tried things like pcap_compile_nocap, and still see the problem.

I'm not following the description of the problem here.
pcap_compile_nopcap takes the filter program as the str argument, and
shouldn't be touching any file handles...

David Maxwell,| --> Mastery of UNIX, like
mastery of language, offers real freedom. The price of freedom is always dear,
but there's no substitute. Personally, I'd rather pay for my freedom than live
in a bitmapped, pop-up-happy dungeon like NT. - Thomas Scoville