title: libpcap: what is the efficiency of pcap_dispatch or pcap_next
body: <p>I use libpcap to capture a lot packets, and then process/modify these packets and send them to another host.</p>
  
  <p>First, I create a libpcap handler <code>handle</code> and set it NON-BLOCKING, and use <code>pcap_get_selecable_fd(handle)</code> to get a corresponding file descriptor <code>pcap_fd</code>.</p>
  
  <p>Then I add an event for this <code>pcap_fd</code> to a libevent loop(it is like select() or epoll()).  </p>
  
  <p>In order to avoid frequently polling this file descriptor, each time there are packet arrival event, I use pcap_dispatch to collect a bufferful of packets and put them into a queue <code>packet_queue</code>, and then call <code>process_packet</code> to process/modify/send each packet in the queue <code>packet_queue</code>.</p>
  
  <pre><code>  pcap_dispatch(handle, -1, collect_pkt, (u_char *)packet_queue);
    process_packet(packet_queue);
  </code></pre>
  
  <p>I use tcpdump to capture the packets that are sent by <code>process_packet(packet_queue)</code>, and notice:</p>
  
  <ol>
  <li>at the very beginning, the interval between sent packets is small</li>
  <li>after that several packets are sent, the interval becomes around 0.055 second</li>
  <li>after 20 packets are sent, the interval becomes 0.031 second and keeps on being 0.031 second</li>
  </ol>
  
  <p>I carefully checked my source code and find no suspicious blocks or logic which leads to so big intervals. So I wonder whether it is due to the problem of the function <code>pcap_dispatch</code>.</p>
  
  <p>are there any efficiency problem on pcap_dispatch or pcap_next or even the libpcap file descriptor?
  thanks!</p>