Wireshark-users: Re: [Wireshark-users] take over responsibility of the pcap_pkthdr *
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 23 Jan 2011 17:13:11 -0800
On Jan 23, 2011, at 4:40 PM, Andrej van der Zee wrote:

> Aha memory mapped between kernel and user-space, good.

Note that I said "might"; the platforms and interfaces where that happens are

	1) regular network interfaces on reasonably recent Linuxes (I think the memory-mapped mechanism has been around for several years) and sufficiently recent libpcap (1.0.0 and later);

	2) USB (not "USB network interfaces" - those are covered under "regular network interfaces" - but raw USB bus sniffing) on sufficiently recent Linuxes and sufficiently recent libpcap (1.1.0 and later; 1.0.0 USB capture support had a number of bugs);

	3) regular network interfaces on, I think, FreeBSD 8.0 and later.

On other platforms and other adapters, there's a copy from the kernel to userland.