c - pcap_loop 函数不是 "reactive"。为什么？

Question

为什么调用pcap_loop函数后，必须等几秒才能抓到第一个包？

void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);

int main(int argc, char * argv[])
{
    pcap_t * handle;
    char dev_name[] = "en0";
    char err_buf[PCAP_ERRBUF_SIZE];

    handle = pcap_open_live(dev_name, 4096, 1, 0, err_buf);

    if (handle == NULL) {
        fprintf(stderr, "Couldn't open device %s: %s\n" , dev_name , err_buf);
        exit(1);
    }

    pcap_loop(handle, 1, print_packet, NULL);
    pcap_close(handle);

    exit(0);
}

void print_packet(u_char * args, const struct pcap_pkthdr * hdr, const u_char * buff)
{
    /* ... */
}

Answer 1

我通过阅读 pcap_open_live 文档发现了问题:

pcap_t *pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, char *errbuf)

[...] to_ms specifies the read timeout in milliseconds. The read timeout is used to arrange that the read not necessarily return immediately when a packet is seen, but that it wait for some amount of time to allow more packets to arrive and to read multiple packets from the OS kernel in one operation. Not all platforms support a read timeout; on platforms that don't, the read timeout is ignored. A zero value for to_ms, on platforms that support a read time- out, will cause a read to wait forever to allow enough packets to arrive, with no timeout. [...]

Source .