🚀 go-pugleaf

"Patrick Wong" <patrickwong@computer.org> wrote in message
news:42a8ffee$1@newsgroups.borland.com...

> Are there other means to capture packets without a
> tight loop, while packets would not be missed?

WinPCap, http://www.winpcap.org


Gambit

Patrick Wong wrote:
> Dear all,
> 
> I am thinking of developing a sniffer program to monitor packets on two
> servers.  I referenced some samples on the web and found several
> interesting.  One of which was developed in Delphi so changing it into BCB
> would not be hard.
> 
> I did some porting and have a trial, and found it has a short-coming.  The
> program uses raw socket to capture packets between two machines.  It does
> the capture in a thread:
> 
> //--------------------------------------------------------------------------
> -
> void __fastcall TSnifferThread::Execute()
> {
>   //---- Place thread code here ----
>   int         addr, iRet;
> 
>   iMySocketState = InitSocket(); /* Initialize the SOCKET */
> 
>   while(!Terminated)
>   {
>     // Save the received packet into a buffer
>     iRet = recv(RawSocket, buf, sizeof(buf), 0);
> 
>     if(iRet == -1)
>       continue;
> 
>     pipheader = PIP_Header(buf); // Transform the received packet into a
> defined structure
> 
>     if((pipheader->ip_destaddr != FDestIp) || (pipheader->ip_srcaddr !=
> FSrcIp))
>       continue;
> 
>     // Display the packet information on a main thread's ListView
>     try
>     {
>       pBuf = new char[iRet];
>       CopyMemory(pBuf, buf, iRet);
>       Synchronize(AddListItem);
>     }
>     __finally
>     {
>       if(pBuf != (char *)NULL)
>       {
>         delete pBuf;
>         pBuf = (char *)NULL;
>       }
>     }
> 
>     Application->ProcessMessages();
>   }
> 
>   if(ip != (char *)NULL)
>   {
>     delete ip;
>     ip = (char *)NULL;
>   }
> }
> 
> The problem is, the thread keeps looping tightly to capture packets, causing
> almost 100% CPU usage.  Are there other means to capture packets without a
> tight loop, while packets would not be missed?
> 
> Many thanks,
> Patrick
> 
> 
I do not know if it works with raw sockets but normally you can use 
select to wait for data to become available.

Also I guess the code has put the socket in non-blocking mode. You could 
try to use blocking mode in which case recv would wait for data to 
become available.

Eelke

"Eelke" <e.klein@mplussoftware.nl> wrote in message
news:42a93417$1@newsgroups.borland.com...
>
> Also I guess the code has put the socket in non-blocking mode. You could
> try to use blocking mode in which case recv would wait for data to
> become available.
>
I add a statement
 ioctlsocket(RawSocket, FIONBIO, 0);

This disables the socket to be non-blocking?  The problem is still there.

"Remy Lebeau (TeamB)" <no.spam@no.spam.com> wrote in message
news:42a93494$1@newsgroups.borland.com...
>
>
> WinPCap, http://www.winpcap.org
>

Thanks for your info.  This might be a better approach.  There is a packet
analyzer "Ethereal" that is developed on top of it, and the source is
available, but it is developed under VC.  I don't have enough time (and
knowledge) to port code from VC to BCB.

Patrick Wong wrote:
> "Eelke" <e.klein@mplussoftware.nl> wrote in message
> news:42a93417$1@newsgroups.borland.com...
> 
>>Also I guess the code has put the socket in non-blocking mode. You could
>>try to use blocking mode in which case recv would wait for data to
>>become available.
>>
> 
> I add a statement
>  ioctlsocket(RawSocket, FIONBIO, 0);
> 
> This disables the socket to be non-blocking?  The problem is still there.
> 
> 
The third argument should by a pointer to an u_long like this:

u_long arg = 0;
ioctlsocket(RawSocket, FIONBIO, &arg);


Eelke