[Bro-Dev] iosource: pcap_set_timeout vs pcap_set_immediate
Valerio
valerio.click at gmx.com
Fri Jun 30 12:00:04 PDT 2017
Hi all,
looking at PcapSource::OpenLive() in iosource/pcap/Source.cc I was
wondering whether it would be better to use pcap_set_immediate instead
of "setting the smallest time-out possible" with pcap_set_timeout.
Could it be that, especially in high-throughput environments, the
introduced timeout in polling on the socket buffer may cause initial
packet loss?
best,
Valerio
More information about the bro-dev
mailing list