CODEWITHSUNDEEP
c++pcaptcpdumplibpcapwinpcap
habi
habi

Reputation: 163

Can multiple threads sniff on same interface at same time?

Hi i am writing a program to sniff packets, using pcap of tcpdump.

For each call from user,a thread is created. That thread will sniff on an interface(probably loopback) and write the captured packets to a file. (pcap dumping)

Is it possible, another thread at the same time sniff on the same interface?

Upvotes: 1

Views: 1747

Answers (2)

Mohammad Rahimi
Mohammad Rahimi

Reputation: 1113

I have two different programs that sniff on the same interface. One opens the interface and process data and the other opens the same interface for logging. I have checked and I didn't see any packet loss on either of them. These are not in the same program on two different threads, these are two separate programs. I can assume that if you create two pcap_t handles on different threads to sniff the same interface you wont face problems.

Upvotes: 0

user13251981
user13251981

Reputation: 96

No. Libpcap is not thread-safe for access to a single pcap_t *. Newer versions are thread safe in that a call that works on one pcap_t * can be executed in a separate thread from a call that works on a different pcap_t * (in earlier versions, pcap_compile() wasn't thread safe at all, even when run on two different pcap_t *'s), but it is not safe to have two separate threads working on the same pcap_t *.

Upvotes: 0

Related Questions