Guy Harris

So does that test program catch SIGINT?

> > So does that test program catch SIGINT? > > Not explicitly, but strace shows that someone is (maybe python's KeyboardInterrupt handler). I'm ok with punting on that for...

> The next thing it does is register fd in our event manager, and it's plausible that this (perhaps incorrectly) causes a call to pcap_next() - but given that there's...

> > > The next thing it does is register fd in our event manager, and it's plausible that this (perhaps incorrectly) causes a call to pcap_next() - but given...

Why not hardware time stamps for transmitted packets as well?

Reading, or writing? You're talking about writing files in the body, but reading them in the title. For writing a file, the one risk is that code that assumes that...

Submitted by guy_harris A version that dynamically allocates and reallocates the buffer, rather than imposing an arbitrary 1500-byte limit, might be better. Even a version that prints a warning and...

It might help figure out the cause of the failure if the error message included the name of the device and the offending filter, with a change such as this:...

The only tradeoff I see is that if you drop support for libpcap < 1.0 you drop support for old UN\*Xes that shipped with older libpcaps, unless the user builds...

[The list of NT status values](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) says that's STATUS_ACCESS_VIOLATION, which is "The instruction at 0xXXXXXXXX referenced memory at 0xXXXXXXXX. The memory could not be {read, written}." That translates into UN\*Xese...