Application with libpcap can only capture all the packets when tcpdump is opened, or only can capture few packets,how to resolve it?thanks -

i have written application, uses libpcap capture packets. application can capture few packets, traffic several kbps. captured traffic on 10mbps if tcpdump opened. when tcpdump closed, captured traffic dropped several kbps again.

anyone know why? thank much.

if you're calling pcap_open_live(), you're passing 0 ''promisc'' argument. if you're calling pcap_create() , pcap_activate(), you're not calling pcap_set_promisc() between calls (or passing pcap_set_promisc() ''promisc'' argument of 0).

i.e., you're not turning promiscuous mode on, machine capturing traffic , machine, not other traffic on network. tcpdump, default, turns promiscuous mode on, so, while it's running, adapter on you're capturing, same adapter 1 on tcpdump capturing, in promiscuous mode, , you'll see other traffic on network.