Question

Why is it that after the pcap_loop function has been called, I must wait several seconds to capture the first packets?

void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);

int main(int argc, char * argv[])
{
    pcap_t * handle;
    char dev_name[] = "en0";
    char err_buf[PCAP_ERRBUF_SIZE];

    handle = pcap_open_live(dev_name, 4096, 1, 0, err_buf);

    if (handle == NULL) {
        fprintf(stderr, "Couldn't open device %s: %s\n" , dev_name , err_buf);
        exit(1);
    }

    pcap_loop(handle, 1, print_packet, NULL);
    pcap_close(handle);

    exit(0);
}

void print_packet(u_char * args, const struct pcap_pkthdr * hdr, const u_char * buff)
{
    /* ... */
}

Answer 1

I’ve found the problem by reading pcap_open_live documentation:

pcap_t *pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, char *errbuf)

[…] to_ms specifies the read timeout in milliseconds. The read
timeout is used to arrange that the read not necessarily return immediately when a packet is seen,
but that it wait for some amount of time to allow more packets to arrive and to read multiple packets
from the OS kernel in one operation. Not all platforms support a read timeout; on platforms that
don’t, the read timeout is ignored. A zero value for to_ms, on platforms that support a read time-
out, will cause a read to wait forever to allow enough packets to arrive, with no timeout. […]

Source.