Subject: RE: Question about libpcap
To: None <>
From: Gerald Lee <>
List: tech-net
Date: 07/23/2007 16:23:37
Darren Reed replied:
> Gerald Lee wrote:
>>      We have a unique situation.  An engineer want to use libpcap to
>> create compile a packet filter.  However, he wants to use it purely
>> memory.  The problem comes in that the application is threaded, and
>> of the other threads is blocked on stdin.  This causes the parser to
>> attempt to get more input from stdin.  He tracked it down to the
>> of yyin, and would just as soon directly manipulate it.  Others of us
>> are discouraging this approach.
>>      However, I need to give him either 1) the appropriate
>> incantations, or 2) a new interface (or variation on the current
>> We've tried things like pcap_compile_nocap, and still see the
>>      Suggestions for either the correct usage (preferred), or
>> suggestions for a name for a new entry point (even if we are the only
>> ones using it ;).
> This sounds like an application bug...
> ...or
> ...perhaps an interaction problem if the lex/yacc code being
> used by bpf is interacting incorrectly with lex/yacc used by
> the application elsewhere?
    That may be.  But this is unique in that it is a threaded
application rather than a more traditional application.  Also,
this is only a problem when the other thread is waiting on
input from the tty.
    I've not had time as yet to look at his code, nor to
try to check for untoward interaction.  It doesn't seem that
he is doing anything wrong.  So far it has been my assumption,
and yes I know what that means, that it is an interaction that
wasn't expected by the library designer(s).  I've looked at
both the man page and the header file, and so far, what
he claims to be doing seems alright.
> darren
- bob