[Winpcap-users] Using threads.

[Guy Harris]

David Barnish wrote:
> Whether the read call blocks or not depends on the read timeout value
> passed to the pcap_openxxx() function and the SetMinToCopy() value if
> used. If the pcap_openxxx() function was told to return immediately (a
> -1 is passed I believe for param 4), the pcap_dispatch() and
> pcap_next_ex() will return immediately whether there are any packets to
> read or not.

...but that's independent of whether you use pcap_dispatch() or 
pcap_next_ex().

> The code that Ramiro included showed that a 1 millisecond
> read timeout is used. So, within his while loop, the code will wait at
> most 1 millisecond (give or take a few milliseconds) before it returns.
> When it returns, it may have a packet of data, or it may return a null
> packet pointer if there were no packets to read. So, I still say that he
> is spinning in his while loop and taking away CPU resources from other
> threads.

...and he'd be doing the same with pcap_dispatch(), which can return 
without ever having called the callback routine.

I.e., switching to pcap_dispatch() won't fix that problem; the code path 
to and in the kernel is the same regardless of whether you use 
pcap_dispatch() or pcap_next_ex().

(Using pcap_loop() won't help, either; it just repeatedly calls the read 
op.)