tshark抓包源码分析&简介

1、Dumpcap不停的抓数据

capture_loop_start 启动子线程 pcap_read_handler，一直读取

if (use_threads) {         pcap_queue = g_async_queue_new();         pcap_queue_bytes = 0;         pcap_queue_packets = 0;         for (i = 0; i < global_ld.pcaps->len; i++) {             pcap_opts = g_array_index(global_ld.pcaps, pcap_options *, i); #if GLIB_CHECK_VERSION(2,31,0)             /* XXX - Add an interface name here? */             pcap_opts->tid = g_thread_new("Capture read", pcap_read_handler, pcap_opts); #else             pcap_opts->tid = g_thread_create(pcap_read_handler, pcap_opts, TRUE, NULL); #endif         }     }   如上蓝色函数名称pcap_read_handler 表示写队列对应的读函数   pcap_read_handler(void* arg) {     pcap_options *pcap_opts;     char          errmsg[MSG_MAX_LENGTH+1];       pcap_opts = (pcap_options *)arg;       g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Started thread for interface %d.",           pcap_opts->interface_id);       while (global_ld.go) {         /* dispatch incoming packets */         capture_loop_dispatch(&global_ld, errmsg, sizeof(errmsg), pcap_opts);     }     g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_INFO, "Stopped thread for interface