🚀 go-pugleaf

Patrick Wong wrote:
> Dear all,
> 
> I am thinking of developing a sniffer program to monitor packets on two
> servers.  I referenced some samples on the web and found several
> interesting.  One of which was developed in Delphi so changing it into BCB
> would not be hard.
> 
> I did some porting and have a trial, and found it has a short-coming.  The
> program uses raw socket to capture packets between two machines.  It does
> the capture in a thread:
> 
> //--------------------------------------------------------------------------
> -
> void __fastcall TSnifferThread::Execute()
> {
>   //---- Place thread code here ----
>   int         addr, iRet;
> 
>   iMySocketState = InitSocket(); /* Initialize the SOCKET */
> 
>   while(!Terminated)
>   {
>     // Save the received packet into a buffer
>     iRet = recv(RawSocket, buf, sizeof(buf), 0);
> 
>     if(iRet == -1)
>       continue;
> 
>     pipheader = PIP_Header(buf); // Transform the received packet into a
> defined structure
> 
>     if((pipheader->ip_destaddr != FDestIp) || (pipheader->ip_srcaddr !=
> FSrcIp))
>       continue;
> 
>     // Display the packet information on a main thread's ListView
>     try
>     {
>       pBuf = new char[iRet];
>       CopyMemory(pBuf, buf, iRet);
>       Synchronize(AddListItem);
>     }
>     __finally
>     {
>       if(pBuf != (char *)NULL)
>       {
>         delete pBuf;
>         pBuf = (char *)NULL;
>       }
>     }
> 
>     Application->ProcessMessages();
>   }
> 
>   if(ip != (char *)NULL)
>   {
>     delete ip;
>     ip = (char *)NULL;
>   }
> }
> 
> The problem is, the thread keeps looping tightly to capture packets, causing
> almost 100% CPU usage.  Are there other means to capture packets without a
> tight loop, while packets would not be missed?
> 
> Many thanks,
> Patrick
> 
> 
I do not know if it works with raw sockets but normally you can use 
select to wait for data to become available.

Also I guess the code has put the socket in non-blocking mode. You could 
try to use blocking mode in which case recv would wait for data to 
become available.

Eelke