From 91801e72ed60e346ac9e525fa53a5c6707a8a772 Mon Sep 17 00:00:00 2001 From: Jacob Baines Date: Thu, 3 Oct 2019 18:02:44 -0400 Subject: [PATCH] Flush Packet to PCAP I was doing some work on a Raspberry Pi with libtins. Specifically, I was writing unique beacons to a pcap file. However, at the end of some runs the pcap would be empty. The [PCAP man page](https://www.tcpdump.org/manpages/pcap.3pcap.html) states the following: > Packets written with pcap_dump() may be buffered, rather than being immediately written to the "savefile". > Closing the pcap_dumper_t will cause all buffered-but-not-yet-written packets to be written to the ``savefile''. Unfortunately, due to the nature of the RPI, the termination of my program is rarely clean. Meaning pcap_close() will almost certainly never be called. A simple work around is to call pcap_dump_flush() after every write to ensure, no matter what, that the packets get written to the pcap file instead of stored in memory indefinitely. --- src/packet_writer.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/src/packet_writer.cpp b/src/packet_writer.cpp index f0072d8f..756fafa8 100644 --- a/src/packet_writer.cpp +++ b/src/packet_writer.cpp @@ -77,6 +77,7 @@ void PacketWriter::write(PDU& pdu, const struct timeval& tv) { PDU::serialization_type buffer = pdu.serialize(); header.caplen = static_cast(buffer.size()); pcap_dump((u_char*)dumper_, &header, &buffer[0]); + pcap_dump_flush(dumper_); } void PacketWriter::init(const string& file_name, int link_type) {