Mends.One

100% cpu usage with a libpcap simple example

Network Programming, Libpcap, C, Linux

while running the code below, one of the CPU cores reaches 100% usage. With or without traffic. What is wrong?

Example code:

#include <stdio.h>
#include <stdlib.h>
#include <pcap.h>
#include <errno.h>

void my_callback(u_char *args, const struct pcap_pkthdr* pkthdr, const u_char*
packet)
{
    //nothing, nothing at all...
    //printf("+");
}

int main(int argc,char **argv)
{
    int i;
    char *dev;
    char errbuf[PCAP_ERRBUF_SIZE];
    pcap_t* descr;
    const u_char *packet;
    struct bpf_program fp;        /* hold compiled program */
    bpf_u_int32 maskp;            /* subnet mask */
    bpf_u_int32 netp;             /* ip */

    if(argc != 2){
        fprintf(stdout, "Usage: %s \"expression\"\n"
            ,argv[0]);
        return 0;
    }

    /* Now get a device */
    dev = pcap_lookupdev(errbuf);

    if(dev == NULL) {
        fprintf(stderr, "%s\n", errbuf);
        exit(1);
    }
    /* Get the network address and mask */
    pcap_lookupnet(dev, &netp, &maskp, errbuf);
    /* open device for reading in promiscuous mode */
    descr = pcap_open_live(dev, BUFSIZ, 1,-1, errbuf);
    if(descr == NULL) {
        printf("pcap_open_live(): %s\n", errbuf);
        exit(1);
    }

    /* Now we'll compile the filter expression*/
    if(pcap_compile(descr, &fp, argv[1], 0, netp) == -1) {
        fprintf(stderr, "Error calling pcap_compile\n");
        exit(1);
    }

    /* set the filter */
    if(pcap_setfilter(descr, &fp) == -1) {
        fprintf(stderr, "Error setting filter\n");
        exit(1);
    }

    /* loop for callback function */
    pcap_loop(descr, -1, my_callback, NULL);
    return 0;
}

compile with: gcc example.c -o example -lpcap

run with: ./example "tcp" or the filter you like.

As you can see it is the typical example, the main and the callback function for the loop: pcap_loop(descr, -1, my_callback, NULL);

The callback is empty (useless) but it is just to show that the problem is not in the callback.

7
S
Salvatorelab
Jump to: Answer 1

Answers (1)

You specified timeout -1 here:

descr = pcap_open_live(dev, BUFSIZ, 1,-1, errbuf);

It turns pcap_loop into a busy loop, as poll continuously times out instantly.

Use something like 1000 (milliseconds) if you have no reason for other value.

7
A
Anton Kovalenko

Comments:

Bill Tarbell said:
absolutely brilliant. I had used -1 at the advice of some other article to gain realTime reporting. Didn't realize it created the busy loop. 1ms was sufficient for me to avoid the batch effect of default. CPU core went from maxed to never reaching even 1%.

Related Questions