Re: announce: pcap, a binding to libpcap

[Sam Roberts <vieuxtech@...>]

On Tue, Apr 12, 2011 at 1:38 PM, Javier Guerra Giraldez
<javier@guerrag.com> wrote:
> On Tue, Apr 12, 2011 at 2:27 PM, Sam Roberts <vieuxtech@gmail.com> wrote:
>> It doesn't implement the full libpcap interface, just what we've needed so far.
>
> in the README it's mentioned about live capturing, but i don't see how
> to do that with your library.   or maybe you implement only the file
> read/write api?

Sorry Javier, you are correct! *blush*

We do read from the network in our lua code, but it looks like we
always do it with PF_PACKET sockets or nfqueue. I'm going to need live
reading in the next week or so, I guess I'll add it, soon. Until then,
there's your code.

Btw, I'd merge in parts of your binding, but it doesn't quite work for us:
- it has no copyright info
- it errors instead of returning nil,emsg (its easier to wrap in
assert when you want to error than wrap in pcall when you don't)

And as a minor nit, it has a bunch of C code to implement loop with
callbacks from C which can be written in pure lua easily on top of
cap:next().

I can see why you added tcp/ip parsing, without it the packet data
isn't useful. Its really unfortunate that there isn't commonly used
libs in linux for parsing tcp/ip headers, and the code has to be
spread all over. We're trying internally to centralize on libnet for
decoding, because we often decode so we can modify slightly and
reencode, and libnet does reencoding reasonably well, as well as
injection.

Cheers,
Sam