You show some output, but you don't say what else happened. Did it segfault (trap)? Hang? Just terminate silently?

I've never used Pcap, so anything I say at this point is a guess, but a few things stand out in your code.

1. You are passing a loop count of 0 to loop().

   The docs say:

   Read $count packets from the packet capture descriptor $pcap and call the perl function &callback with an argument of $user_data. If $count is negative, then the function loops forever or until an error occurs. Returns 0 if $count is exhausted, -1 on error, and -2 if the loop terminated due to a call to pcap_breakloop() before any packets were processed.

   Which suggest to me that if you want to capture 5 seconds of input and then break the loop, you should be passing -1 for the loop count.

2. Your callback_capture() sub is empty.

   You probably ought to try adding a print statement in there to see a) if you are being call back and b) are you being passed anything.

3. You should definitely be checking (printing) the returns from the Pcap subs--they might be very informative.

   I'd suggest using warn instead fo print for your debug and trace messages as stderr is unbuffered and you may not be seeing stuff that has been printed to stdout but not yet flushed.

It hangs because the catpure thread is at the loop function, my idea is to break that loop using breakloop over the same variable BUT from the main thread.
1- Yes, i've done some tests and looks that 0 is doing exactly the same as -1, but i've changed to -1 now.
2- The callback part works perfectly, i've just remove the contents for the test.
3- Nothing strange at the return codes of the subs.
The problem here is that I can't call breakloop to the same variable at the main thread that is looping at the capture thread and thats why it hangs at the loop function.
I've try it sharing, passing as a parameter to the thread (don't know why it makes a local copy too instead of using the same by reference), i've tried too the last 2 options but using references and found that althoug the references are being copied (as i expected) the content of the references changed too to the copied values inside the thread instead of pointinng to the original variable at the main thread.
I thought it will be easier.

Nothing strange at the return codes of the subs.

That doesn't make much sense. At the very least, I would expect to see the output from

"$capobj breakloop\n";
[download]

If that is not being output, then it suggests that breakloop() is never returning, which is a Pcap issue rather that anything to do with threads.

The callback part works perfectly, i've just remove the contents for the test

Since you creating $capobj in your main thread and using successfully with the capture thread, it suggests that the sharing is working fine.

I've try it sharing, passing as a parameter to the thread (don't know why it makes a local copy too instead of using the same by reference), i've tried too the last 2 options but using references and found that althoug the references are being copied (as i expected) the content of the references changed too to the copied values inside the thread instead of pointinng to the original variable at the main thread.

That's a red-herring. The addresses shown in the printout are the addresses of the references not the thing it points to. The way sharing works it to create a clone specific to each thread that acts as a proxy for the real data.

The notation package=TYPE(address) means that this reference is located in memory at adddress, it points to a variable of type TYPE, and it is bless'd into package. So your output simply means that each of your two threads has it's own reference to the object:

THREAD 1:                     THREAD 2:
pcap_tPtr=SCALAR(0x8ee08f8)   pcap_tPtr=SCALAR(0x8f223b4)
¦                                                        ¦
¦                                                        ¦
+-----------> A perl scalar that <<----------------------+
              holds the address 
              of the pcap struct:
              0xxxxxxxxx
              ¦
              +---> Whatever that struct looks like
[download]

I still suggest that you print the return codes of the calls, switch to using warn and put some trace in the callback.

---

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.

"Science is about questioning the status quo. Questioning authority".

In the absence of evidence, opinion is indistinguishable from prejudice.

"Too many [] have been sedated by an oppressive environment of political correctness and risk aversion."