pcap asynchronous packet capturing

Question

I am capturing IEEE802.11 packets with the pcap library. As yet i used pcap_loop and a callback function for receiving and then processing the packets. But now I have switch the wifi channel the device is listening on periodically. Unfortunately, pcap_loop is blocking so I can't call my function using a timeout. Then I read about pcap_dispatch, but I don't really know how that should work asynchronous, because doing something like

while(1) {
    int cnt = pcap_dispatch(handle, -1, callback, null);
}

wouldn't solve a thing.

So can anyone explain to me how to make pcap capture packets asynchronous / event based or in other words how to solve my dilemma?

Answer 1

To quote the pcap_get_selectable_fd() man page (this is the version from the trunk):

DESCRIPTION

   pcap_get_selectable_fd() returns, on UNIX, a file descriptor number for
   a  file descriptor on which one can do a select() or poll() to wait for
   it to be possible to read packets without blocking, if such a  descrip‐
   tor  exists, or −1, if no such descriptor exists.  Some network devices
   opened   with    pcap_create()    and    pcap_activate(),    or    with
   pcap_open_live(), do not support select() or poll() (for example, regu‐
   lar network devices on FreeBSD 4.3 and 4.4, and Endace DAG devices), so
   −1 is returned for those devices.

   Note that in:

          FreeBSD prior to FreeBSD 4.6;

          NetBSD prior to NetBSD 3.0;

          OpenBSD prior to OpenBSD 2.4;

          Mac OS X prior to Mac OS X 10.7;

   select()   and   poll()   do   not   work  correctly  on  BPF  devices;
   pcap_get_selectable_fd() will return a file descriptor on most of those
   versions  (the  exceptions  being  FreeBSD  4.3  and 4.4), but a simple
   select() or poll() will not indicate that the  descriptor  is  readable
   until  a  full  buffer’s worth of packets is received, even if the read
   timeout expires before then.  To work around this, an application  that
   uses  select()  or  poll()  to  wait for packets to arrive must put the
   pcap_t in non‐blocking mode, and must  arrange  that  the  select()  or
   poll()  have a timeout less than or equal to the read timeout, and must
   try to read packets after that timeout expires, regardless  of  whether
   select() or poll() indicated that the file descriptor for the pcap_t is
   ready to be read or not.  (That workaround will not work in FreeBSD 4.3
   and  later; however, in FreeBSD 4.6 and later, select() and poll() work
   correctly on BPF devices, so the workaround isn’t  necessary,  although
   it does no harm.)

   Note  also that poll() doesn’t work on character special files, includ‐
   ing BPF devices, in Mac OS X 10.4 and 10.5, so, while select()  can  be
   used  on  the  descriptor  returned by pcap_get_selectable_fd(), poll()
   cannot be used on it those versions of Mac OS X.   Kqueues  also  don’t
   work  on  that  descriptor.   poll(),  but  not  kqueues,  work on that
   descriptor in Mac OS X releases prior to 10.4; poll() and kqueues  work
   on that descriptor in Mac OS X 10.6 and later.

   pcap_get_selectable_fd() is not available on Windows.

In addition, the workaround won't work on Mac OS X 10.6, due to a bug in 10.6's BPF (introduced as part of a fix to another bug); the workaround will work on 10.7 and later, but isn't necessary.

So you could make it event-based if you have a select()/poll()/epoll()/kqueue/etc.-based event loop - add the descriptor you get from pcap_get_selectable_fd() as one of the file descriptors selected on in that event loop.