in reply to Real time reading of multiple pcap 'instances' at once

It's a bit long in the tooth now, but you probably could use POE::Component::Pcap (which sits on top of Net::Pcap) and let POE do the nasty socket-y-select-y bits.

Update: Hrmm, wait I glossed over where you need multiple pcap filters. Perhaps you could use all the filters as conditions (joined with 'or') and then figure out which hit for a given packet in your code?

The cake is a lie.
The cake is a lie.
The cake is a lie.

  • Comment on Re: Real time reading of multiple pcap 'instances' at once

Replies are listed 'Best First'.
Re^2: Real time reading of multiple pcap 'instances' at once
by JPaul (Hermit) on Nov 15, 2008 at 01:09 UTC
    I was about to dismiss this as a silly idea, but the voice in the back of my head went "You know, the obvious answer might not be quite as daft as it first seems".

    Although, due to what I'm trapping, I can't really pull the packets into perl and use it to work it out - they do happen to be, currently, all on different ports - which, of course, tcpdump clearly shows. I don't even need to mess with Net::Pcap and it's screwing with SIGALRM - I can simply use my existing implementation with a few extra nuts and bolts. I think.

    Thank you for the probably obvious, but nevertheless gratefully received, suggestion.

    -- Alexander Widdlemouse undid his bellybutton and his bum dropped off --
[reply]

In Section Seekers of Perl Wisdom