I'm sure this has been discussed before but I've been unable to find a proper solution...
Is there a nice portable way to establish a timeout on the resolver routines?
I let trafshow run for several hours when it caused a flood of 'File Table Full' syslog messages. It turns out that the trafshow code sets an alarm() before it calls gethostbyaddr and then it wraps the whole thing inside a setjmp block. When the reverse lookup takes too long, the gethostbyaddr is terminated ungracefully leaving a file descriptor open. After a while, this file descriptor leakage fills up the table.
I've found that trafshow's addrtoname.c was lifted pretty much straight out of the tcpdump collection. The biggest difference is that tcpdump waits 20 seconds whereas trafshow defaults to a 2-second wait in order to keep things moving. So I can only assume that tcpdump would similarly fill up the FD table if given the chance.
I don't know if this is relevant, but trafshow never leaked descriptors until I upgraded from some version of 4.0-STABLE to 4.1-RELEASE. I confirmed this on two machines. I never got around to tracking it down until recently. Sorry.
So what's a portable program to do? How can this FD leakage be avoided?
Thanks in advance,
Barry
--
Barry Mishler
System/Network Manager
Japan Engineer District
U.S. Army Corps of Engineers
