Libnids--函数调用顺序之nids_run()

调用完nids_init()后便是进入nids_run()开始监听网络接口并处理抓获的数据包

• nids_run()

int nids_run()
{
    if (!desc) {
    strcpy(nids_errbuf, "Libnids not initialized");
    return 0;
    }
    START_CAP_QUEUE_PROCESS_THREAD(); /* threading... */
    pcap_loop(desc, -1, (pcap_handler) nids_pcap_handler, 0);
    /* FIXME: will this code ever be called? Don't think so - mcree */
    STOP_CAP_QUEUE_PROCESS_THREAD(); 
    nids_exit();
    return 0;
}

若是使用多线程则通过START_CAP_QUEUE_PROCESS_THREAD()开启一个新的线程，cap_queue_process_thread()这个函数是在这个新线程中运行的函数

START_CAP_QUEUE_PROCESS_THREAD() \
    if(nids_params.multiproc) { /* threading... */ \
    if(!(g_thread_create_full((GThreadFunc)cap_queue_process_thread,NULL,0,FALSE,TRUE,G_THREAD_PRIORITY_LOW,&gerror))) { \
        strcpy(nids_errbuf, "thread: "); \
        strncat(nids_errbuf, gerror->message, sizeof(nids_errbuf) - 8); \
        return 0; \
     }; \
    }

ca