Winpcap - pcap_next_ex vs pcap_loop

Question

I have a question, Imagine I have a thread which captures packets and process them itself.

With pcap_next_ex: I would use a loop and I would process the packets in each interaction, suppose I call Sleep(200) to simulate the stuff. With pcap_next_ex I would arrive a moment when I would lose packets.

With pcap_loop: I would use a callback to a packet handler for each packet incoming it would work like an event. In the packet handler I would treat the packets and suppose I call Sleep(200) to simulate the stuff. Would I lose packets?.

Answer 1

Yes.

pcap_next_ex and pcap_loop call the same internal function that reads a packet from the ring buffer. The difference is only that the former return the packet but the latter calls a callback with the packet.

pcap_loop calls the callback in the same thread as one called the pcap_loop, and waits for the callback to complete its task before reading the next packet. So, if the callback takes a long time, the pcap_loop cannot read packets enough frequently, which results in more possibility to lose packets.