I am experimenting with Bro v2.3.1 using a version of libpcap that does not support an fd to call select() on.
I noticed that earlier versions had a compile time option --disable-select-loop to disable the use of this within Bro. The only way I could find to use the recent version of Bro was to modify the code in a similar way to the conditional compilation used by --disable-select-loop (forcing ‘idle = false’ in PktSrc::ExtractNextPacket).
Have I missed any Bro configuration (compile or run time) that will allow it to busy wait in recent versions? Is the intention for current and future versions of Bro to rely on selectable fd support in libpcap?
Thanks in advance for any advice.