Use immediate mode if available.

If libpcap has pcap_set_immediate_mode(), then default to immediate mode
if we're printing packets to a terminal, and use immediate mode if
--immediate-mode is specified.

diff --git a/config.h.in b/config.h.in
index 9ed68ff352b5dcaed364e67965420ebeb7cae53b..43a6bc1b753ea43aeeff6c1a81608ab6af9e1f02 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -133,6 +133,9 @@
 /* Define to 1 if you have the `pcap_set_datalink' function. */
 #undef HAVE_PCAP_SET_DATALINK
 
+/* Define to 1 if you have the `pcap_set_immediate_mode' function. */
+#undef HAVE_PCAP_SET_IMMEDIATE_MODE
+
 /* Define to 1 if you have the `pcap_set_tstamp_precision' function. */
 #undef HAVE_PCAP_SET_TSTAMP_PRECISION
 

diff --git a/configure b/configure
index 13ad7725ad79cd3c90748716c13ac045bf2c2828..87d6992bd08e60d548f17669a43e97fb56feea9b 100755 (executable)
--- a/configure
+++ b/configure
@@ -6677,7 +6677,11 @@ done
 
 fi
 
-for ac_func in pcap_findalldevs pcap_dump_flush pcap_lib_version pcap_setdirection
+#
+# Check for a miscellaneous collection of functions which we use
+# if we have them.
+#
+for ac_func in pcap_findalldevs pcap_dump_flush pcap_lib_version pcap_setdirection pcap_set_immediate_mode
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"

diff --git a/configure.in b/configure.in
index 01debc98eb3fb8a83d304fd358f3b6a860927af4..7c860dc0787cc38380fd7371706c97b59f5f31ab 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -828,7 +828,11 @@ if test $ac_cv_func_pcap_create = "yes" ; then
        AC_CHECK_FUNCS(pcap_set_tstamp_precision)
 fi
 
-AC_CHECK_FUNCS(pcap_findalldevs pcap_dump_flush pcap_lib_version pcap_setdirection)
+#
+# Check for a miscellaneous collection of functions which we use
+# if we have them.
+#
+AC_CHECK_FUNCS(pcap_findalldevs pcap_dump_flush pcap_lib_version pcap_setdirection pcap_set_immediate_mode)
 if test $ac_cv_func_pcap_findalldevs = "yes" ; then
 dnl Check for Mac OS X, which may ship pcap.h from 0.6 but libpcap may
 dnl be 0.8; this means that lib has pcap_findalldevs but header doesn't

diff --git a/netdissect.h b/netdissect.h
index 58e88aa8287f3f90c1647e76f209abaa7961578c..515d839d733b1bcd7f2a0d668218bbdb374ac623 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -115,6 +115,7 @@ struct netdissect_options {
   int ndo_dlt;                  /* if != -1, ask libpcap for the DLT it names*/
   int ndo_jflag;                /* packet time stamp source */
   int ndo_pflag;                /* don't go promiscuous */
+  int ndo_immediate;            /* use immediate mode */
 
   int ndo_Cflag;                /* rotate dump files after this many bytes */
   int ndo_Cflag_count;      /* Keep track of which file number we're writing */

diff --git a/tcpdump.1.in b/tcpdump.1.in
index 6db259e936fa6342d1c7655ca3de90e34f57bc6f..2314bc8cd79ced4818fdbd245c4fc023cce71e4c 100644 (file)
--- a/tcpdump.1.in
+++ b/tcpdump.1.in
@@ -128,6 +128,10 @@ tcpdump \- dump traffic on a network
 [
 .BI \-\-time\-stamp\-precision= tstamp_precision
 ]
+.ti +8
+[
+.B \-\-immediate\-mode
+]
 [
 .B \-\-version
 ]
@@ -421,6 +425,13 @@ monitor mode will be shown; if
 is specified, only those link-layer types available when in monitor mode
 will be shown.
 .TP
+.BI \-\-immediate\-mode
+Capture in "immediate mode".  In this mode, packets are delivered to
+tcpdump as soon as they arrive, rather than being buffered for
+efficiency.  This is the default when printing packets rather than
+saving packets to a ``savefile'' if the packets are being printed to a
+terminal rather than to a file or pipe.
+.TP
 .BI \-j " tstamp_type"
 .PD 0
 .TP

diff --git a/tcpdump.c b/tcpdump.c
index e2f77aefaae4d6893995d1af4d46f15c383624d6..1eb2e206b6ec1b9a6a12eebc8f576117983aa9b1 100644 (file)
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -669,6 +669,7 @@ show_devices_and_exit (void)
  */
 #define OPTION_VERSION         128
 #define OPTION_TSTAMP_PRECISION        129
+#define OPTION_IMMEDIATE_MODE  130
 
 static const struct option longopts[] = {
 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
@@ -700,6 +701,9 @@ static const struct option longopts[] = {
        { "packet-buffered", no_argument, NULL, 'U' },
 #endif
        { "linktype", required_argument, NULL, 'y' },
+#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
+       { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
+#endif
 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
        { "debug-filter-parser", no_argument, NULL, 'Y' },
 #endif
@@ -948,6 +952,7 @@ main(int argc, char **argv)
        gndo->ndo_error=ndo_error;
        gndo->ndo_warning=ndo_warning;
        gndo->ndo_snaplen = DEFAULT_SNAPLEN;
+       gndo->ndo_immediate = 0;
 
        cnt = -1;
        device = NULL;
@@ -1355,6 +1360,12 @@ main(int argc, char **argv)
                        break;
 #endif
 
+#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
+               case OPTION_IMMEDIATE_MODE:
+                       gndo->ndo_immediate = 1;
+                       break;
+#endif
+
                default:
                        print_usage();
                        exit(1);
@@ -1390,6 +1401,17 @@ main(int argc, char **argv)
        if (VFileName != NULL && RFileName != NULL)
                error("-V and -r are mutually exclusive.");
 
+#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
+       /*
+        * If we're printing dissected packets to the standard output
+        * rather than saving raw packets to a file, and the standard
+        * output is a terminal, use immediate mode, as the user's
+        * probably expecting to see packets pop up immediately.
+        */
+       if (WFileName == NULL && isatty(1))
+               gndo->ndo_immediate = 1;
+#endif
+
 #ifdef WITH_CHROOT
        /* if run as root, prepare for chrooting */
        if (getuid() == 0 || geteuid() == 0) {
@@ -1515,6 +1537,15 @@ main(int argc, char **argv)
                                pcap_statustostr(status));
 #endif
 
+#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
+               if (gndo->ndo_immediate) {
+                       status = pcap_set_immediate_mode(pd, 1);
+                       if (status != 0)
+                               error("%s: Can't set immediate mode: %s",
+                               device,
+                               pcap_statustostr(status));
+               }
+#endif
                /*
                 * Is this an interface that supports monitor mode?
                 */
@@ -2533,6 +2564,9 @@ print_usage(void)
        (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n");
        (void)fprintf(stderr,
 "\t\t");
+#endif
+#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
+       (void)fprintf(stderr, "[ --immediate-mode ] ");
 #endif
        (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n");
        (void)fprintf(stderr,