[Bro-Dev] iosource: pcap_set_timeout vs pcap_set_immediate

Valerio valerio.click at gmx.com
Fri Jun 30 12:00:04 PDT 2017

Hi all,

looking at PcapSource::OpenLive() in iosource/pcap/Source.cc I was
wondering whether it would be better to use pcap_set_immediate instead
of "setting the smallest time-out possible" with pcap_set_timeout.

Could it be that, especially in high-throughput environments, the
introduced timeout in polling on the socket buffer may cause initial
packet loss?


More information about the bro-dev mailing list