pcap and processing packets

[Hadi Rezaee]

Hello everybody,
I'm about writing a packet filter using libpcap .. I just have two
theoretical question that I hope to get them answered here.

1)
Let say, I've initialed pcap on my ethernet nic using "pcap_open_live"
(in non-blocking-mode) and "pcap_dispatch". lets assume that the user
callback function (for dispatch) is implemented in not optimal manner
that takes for example 5 seconds to finish processing each packet. I
want to know what will happen to ongoing incoming packets ?! are they
getting buffered or queued somewhere in OS ? or they just get simply
dropped ?

2)
When i initial pcap with pcap_open_live, and I set "to_ms"
(read-timeout) parameter to zero .. I cannot catch a thing ! it has to
be more than zero to work .. Is it normal behavior ?

Thanks,

-- 
Hadi Rezaee
+98 912 1403571

IdeaTech.io