Skip to content

Fix sniff timeout when libpcap select returns readable with no packets#5008

Open
T3pp31 wants to merge 1 commit into
secdev:masterfrom
T3pp31:fix/4590-sniff-timeout
Open

Fix sniff timeout when libpcap select returns readable with no packets#5008
T3pp31 wants to merge 1 commit into
secdev:masterfrom
T3pp31:fix/4590-sniff-timeout

Conversation

@T3pp31
Copy link
Copy Markdown
Contributor

@T3pp31 T3pp31 commented Jun 1, 2026

Summary

  • When sniff(..., timeout=N) uses a libpcap socket, select may report the capture fd as readable even when no BPF-matched packets are available; a blocking pcap_next_ex in recv() could then stall past the sniff timeout (same class as Timeout doesn't work when no sniffing results with L2pcapListenSocket #74).
  • Timed sniff loops now call nonblock_recv() when the socket supports it, via a nonblock flag on session recv().
  • Adds a mock regression test that simulates libpcap always returning the socket from select while nonblock_recv() yields no packet.

Fixes #4590

Test plan

  • New regression test: sniff timeout with select-ready but empty pcap socket (#4590) in test/regression.uts
  • Manual verification: mock socket completes within ~1s with timeout=1, blocking recv() never called
  • CI (UTscapy on Linux with libpcap)

Made with Cursor

Use nonblock_recv() in timed sniff loops when the socket supports it,
so a blocking pcap_next_ex cannot stall past the sniff timeout (secdev#4590).

Regression test simulates libpcap reporting the fd as readable while
nonblock_recv returns no BPF-matched packet.

Co-authored-by: Cursor <cursoragent@cursor.com>
@gpotter2
Copy link
Copy Markdown
Member

gpotter2 commented Jun 2, 2026

Hi & thanks for the PR !

It has great performance implications to use a non blocking read instead of a blocking one. I am therefore not sure that this is the proper way of tackling the issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

sniff does not terminate on timeout

2 participants