大神们， 请问以下这个问题后面怎么解决的？

Question

关于pcap_dispatch（）的使用。为什么每次捕包的时候还没等超时结束，pcap_dispatch就返回了？？？？急等

Answer 1

你好，我也碰到了类似问题，在redhat下，不到超时就返回了，检查了一下返回值是0，也就是说读到了EOF，但是相同程序在ubuntu下运行就可以在指定时间后返回，建议你查一下返回值，换一个平台或者重新安装包。

Answer 2

代码里面的user和参数的filename没有看到你怎么定义的。用pcap_loop或者pcap_next相关的函数试试看。另外，你根据帮助文档看看，尤其是检测一下返回值。这系列相关的函数和平台版本等都有关系的。NAMEpcap_loop, pcap_dispatch - process packets from a live capture or save-fileSYNOPSIS#include <pcap/pcap.h>typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,const u_char *bytes);int pcap_loop(pcap_t *p, int cnt,pcap_handler callback, u_char *user);int pcap_dispatch(pcap_t *p, int cnt,pcap_handler callback, u_char *user);DESCRIPTIONpcap_loop() processes packets from a live capture or ``savefile'' untilcnt packets are processed, the end of the ``savefile'' is reached whenreading from a ``savefile'', pcap_breakloop() is called, or an erroroccurs. It does not return when live read timeouts occur. A value of-1 or 0 for cnt is equivalent to infinity, so that packets are pro-cessed until another ending condition occurs.pcap_dispatch() processes packets from a live capture or ``savefile''until cnt packets are processed, the end of the current bufferful ofpackets is reached when doing a live capture, the end of the ``save-file'' is reached when reading from a ``savefile'', pcap_breakloop() iscalled, or an error occurs. Thus, when doing a live capture, cnt isthe maximum number of packets to process before returning, but is not aminimum number; when reading a live capture, only one bufferful ofpackets is read at a time, so fewer than cnt packets may be processed.A value of -1 or 0 for cnt causes all the packets received in onebuffer to be processed when reading a live capture, and causes all thepackets in the file to be processed when reading a ``savefile''.(In older versions of libpcap, the behavior when cnt was 0 was unde-fined; different platforms and devices behaved differently, so codethat must work with older versions of libpcap should use -1, nor 0, asthe value of cnt.)callback specifies a routine to be called with three arguments: au_char pointer which is passed in the user argument to pcap_loop() orpcap_dispatch(), a const struct pcap_pkthdr pointer pointing to thepacket time stamp and lengths, and a const u_char pointer to the firstcaplen (as given in the struct pcap_pkthdr a pointer to which is passedto the callback routine) bytes of data from the packet.RETURN VALUEpcap_loop() returns 0 if cnt is exhausted, -1 if an error occurs, or -2if the loop terminated due to a call to pcap_breakloop() before anypackets were processed. It does not return when live read timeoutsoccur; instead, it attempts to read more packets.pcap_dispatch() returns the number of packets processed on success;this can be 0 if no packets were read from a live capture (if, forexample, they were discarded because they didn't pass the packet fil-ter, or if, on platforms that support a read timeout that starts beforeany packets arrive, the timeout expires before any packets arrive, orif the file descriptor for the capture device is in non-blocking modeand no packets were available to be read) or if no more packets areavailable in a ``savefile.'' It returns -1 if an error occurs or -2 ifthe loop terminated due to a call to pcap_breakloop() before any pack-ets were processed. If your application uses pcap_breakloop(), makesure that you explicitly check for -1 and -2, rather than just checkingfor a return value < 0.If -1 is returned, pcap_geterr() or pcap_perror() may be called with pas an argument to fetch or display the error text.请采纳。