c - Why is there a long delay between pcap_loop() and getting a packet? -

i'm writing sniffer using libpcap. problem there's 7-10 second delay between calling pcap_loop() or pcap_next() , getting packet(the callback function being called). however, if use wireshark same filter on same device, there no such delay after hit "start" button. why there delay in program , there way fix that?

i'm working on atheros wifi chips. device set monitor mode using

airmon-ng start wlan0 

i'm sure there're plenty of traffic listen to, can see packages in wireshark. thank you.

i'm using 10000

the to_ms argument pcap_open_live() , pcap_set_timeout() in milliseconds.

10000 milliseconds 10 seconds.

try using 1000, value tcpdump uses - that'll reduce delay 1 second - or using 100, value wireshark uses - that'll reduce delay 1/10 second.

i read on tutorial field: " on @ least platforms, means may wait until sufficient number of packets arrive before seeing packets, should use non-zero timeout"

the tutorial in question the tcpdump.org "how use libpcap" tutorial, , passage in question added in cvs commit:

revision 1.8 date: 2005/08/27 23:58:39;  author: guy;  state: exp;  lines: +34 -31 use non-zero timeout in pcap_open_live(), don't wait bufferful of packets before processed.  correctly explain difference between pcap_loop() , pcap_dispatch().  in sniffex.c, don't print payload if there isn't any. 

so i'm familiar it. :-)

i'd have spend time looking @ linux kernel code (again) see effect timeout value of 0 have on newer kernels. however, when writing code uses libpcap/winpcap live captures, should always act if you're writing code such platform; code more portable other platforms and not break if behavior of 0 timeout changes.