March 2010

Our visual traffic analysis software makes peripheral use of 1.2 rc4 (the API changes for rc5 would force us to rework some things that don't really make any practical difference, though we'll probably update this at some point) for hex display and pcap exporting. For more information see http://www.eqnets.com. We're in beta; for details see our last blog post.

The native IO, memory and buffer management package provides java classes and native API work working with objects and native memory structures. This package will provide the already familiar JMemory and JBuffer java classes but also a standard native library of functions for performing memory management and manipulation tasks.

Specifically new set of function calls are provided for much greater flexibility in memory management. The key purpose of this module is to ensure that any binding between java and native memory, have the same life-cycle and when either one is no longer needed, both are properly and released. The nio NDK provides operations on the following 3 classes of memories:

1. monolithic native memory blocks
2. non-monolitich native memory chains
3. java object reference life-cycles when referenced from within native structures

Memory allocated using nio NDK is not a simple monolithic block of memory, but rather a chain of memory blocks that are linked together that act as a single allocated unit, that when no longer needed, will properly release all of its previously allocated components. This new memory model at the native level, allows various previously static structures to be expanded/contracted at runtime and at will, while still being tied to the life-cycle of the parent java object. When a java object holding reference to previously allocated nio memory is garbage collected by java, the native memory is also released at the same time.

Native structures can reference other java objects and have those references released when their parent object is GCed. There is additional information attached to the native nio memory chain which keeps track of JNI object references to be released when the nio memory is deallocated. This ensures that any JNI references held by nio memory, releases the JNI references allowing those referenced objects to be eventually GCed.

[MWB - 3/16/10: this is still work in progress]

This document describes the jnetpcap 2.0 design. Next major step in evolution of jnetpcap software is to make it more manageable in terms of complexity, size and efficiency. The major changes planned for jnetpcap 2.0 are as follows:

• Break up into multiple modules: jnetpcap, jnetcommon, jnetdecoder, jnetanalyzer
• Provide a multi-module build script
• Provide a simple Makefile build process for native components, in addition to existing ant scripts
• Provide additional protocol modules for specific protocol families

In addition to release structure changes the following API changes will also be implemented:

• Move common code into more general java packages and bundled into a jnetcommon module
• Remove java dependencies between modules except for the common module
• Acquire new domain for more common code: jnetsoft.org [MWB: already registered]
• Preserve most of the API syntax, but with some classes moved to other java packages in order to facilitate a clean breakup into multiple modules
• Provide a NDK for native development - specific native functionality will be provided with specific native and java API, especially in the native to java memory boundary area

The above changes will depart from the current monolithic API of jnetpcap releases. The jNetPcap module will become a standalone java wrapper for libpcap/winpcap libraries. Additional modules will provide the decode and analyzer features that will be plugged in at runtime.

I used a dispatch() method for the convenience of setting up a timeout.
///
public int dispatch(int cnt,
JPacketHandler handler,
T user)
///
and set 10 seconds timeout in
///
int timeout = 10 * 1000; // 10 seconds in millis
Pcap pcap =
Pcap.openLive(device.getName(), snaplen, flags, timeout, errbuf);
///
and finally invoke the dispatch() method as followed
///
pcap.dispatch(-1, jpacketHandler, "jNetPcap rocks!");
///
But the result always is that once the first packet is captured, the process finishes. The 10-second timeout does not work.
In the note of dispatch(): on some platforms, the read timeout isn't supported, and, on other platforms, the timer doesn't start until at least one packet arrives.
But in my case, the timeout seems to be 'instant' after receiving the first packet.
Thanks for any suggestion or advice on the problem!