tcpwiresharkrecvsniffer

Wireshark Sniffer vs TCP Receive


Say I am capturing data from TCP using RECV function in c++.

I might sound stupid but I would like to know will I get any speed up if I capture the packet through a simple sniffer (maybe using PCAP) and process it?

Thanks


Solution

  • No, it probably won't speed up anything. I rather expect it to be even slower and more memory-consuming. (overhead, overhead, overhead...).

    Additionally, it won't work at all.

    1. No payload will be exchanged if there isn´t a real client which creates a proper connection with the peer.
    2. If there is a connection and you´re relying only on the sniffer without proper receiving the payload in the client, the whole transfer will stop after some amount of data. (Because the buffer is full, and the sender won't send anymore until there is space again).
    3. That means you must call recv, which makes sniffing useless in the first place.