pcap_getnonblock() returns -3

Question

I am quite new to using pcap lib, so please bear with me.

I am trying to use pcap_getnonblock function, the documentation says the following:

pcap_getnonblock() returns the current 'non-blocking' state of the capture descriptor; it always returns 0 on 'savefiles' . If there is an error, PCAP_ERROR is returned and errbuf is filled in with an appropriate error message.
errbuf is assumed to be able to hold at least PCAP_ERRBUF_SIZE chars.

I got -3 returned and the errbuf is an empty string, I couldn't understand the meaning of such result. I believe this caused a socket error: 10065. This problem happened only once and I could not reproduce it, but still it would be great to find its causing to prevent it in future executions.

Thanks in advance.

Answer 1

pcap_getnonblock() can return -3 - that's PCAP_ERROR_NOT_ACTIVATED. Unfortunately, that's not documented; I'll fix that.

Here's a minimal reproducible example that demonstrates this:

#include <pcap/pcap.h>
#include <stdio.h>

int
main(int argc, char **argv)
{
    pcap_t *pcap;
    char errbuf[PCAP_ERRBUF_SIZE];

    if (argc != 2) {
        fprintf(stderr, "Usage: this_program <interface_name>\n");
        return 1;
    }
    pcap = pcap_create(argv[1], errbuf);
    if (pcap == NULL) {
        fprintf(stderr, "this_program: pcap_create(%s) failed: %s\n",
            argv[1], errbuf);
        return 2;
    }
    printf("pcap_getnonblock() returns %d on non-activated pcap_t\n",
        pcap_getnonblock(pcap, errbuf));
    return 0;
}

(yes, that's minimal, as 1) names of interfaces are OS-dependent, so it has to be a command-line argument and 2) if you don't run the program correctly, it should let you know what's happening, so you know what you have to do in order to reproduce the problem).

Perhaps pcap_getnonblock() and pcap_setnonblock() should be changed so that you can set non-blocking mode before activating the pcap_t, so that, when activated, it will be in non-blocking mode. It doesn't work that way currently, however.

I.e., you're allocating a pcap_t with pcap_create(), but you're not activating it with pcap_activate(). You need to do both in order to have a pcap_t on which you can capture.