885         *ebuf = '\0';
 886         pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
 887         if (pd == NULL)

 236 pcap_t *
 237 pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 238     char *ebuf)
 239 {
...
 267         /* Initialize some components of the pcap structure. */
 268
 269         memset(handle, 0, sizeof(*handle));
 270         handle->snapshot        = snaplen;
 271         handle->md.timeout      = to_ms;
...
 492     /* Receive a single packet from the kernel */
 493
 494     bp = handle->buffer + handle->offset;
 495     do {
 496         /*
 497          * Has "pcap_breakloop()" been called?
 498          */
 499         if (handle->break_loop) {
 500             /*
 501              * Yes - clear the flag that indicates that it
 502              * has, and return -2 as an indication that we
 503              * were told to break out of the loop.
 504              */
 505             handle->break_loop = 0;
 506             return -2;
 507         }
 508         fromlen = sizeof(from);
 509         packet_len = recvfrom(
 510             handle->fd, bp + offset,
 511             handle->bufsize - offset, MSG_TRUNC,
 512             (struct sockaddr *) &from, &fromlen);
 513     } while (packet_len == -1 && errno == EINTR);

#include <sys/epoll.h>

.... 중략 ....

#define  EPOLL_EVENTS_COUNT 16
static int epollfd = -1;
static struct epoll_event ev, * epoll_events = NULL;

.... 중략 ....

pcap_t *
pcap_open_live(const char *device, int snaplen, int promisc, int to_ms
    char *ebuf)
{
.... 중략 ....

    handle->selectable_fd = handle->fd;
    do {
        if ( -1 == epollfd)
            epollfd = epoll_create(EPOLL_EVENTS);
        if ( -1 == epollfd )
           break;
        if ( NULL == epoll_events )
             epoll_events = (struct epoll_event *)malloc(sizeof(*epoll_events) * EPOLL_EVENTS);
        ev.events = EPOLLIN;
        ev.data.fd = handle->selectable_fd;
        if ( -1 == epoll_ctl(epollfd, EPOLL_CTL_ADD, handle->selectable_fd, &ev) )
           break;

       handle->read_op = pcap_read_linux;
       handle->inject_op = pcap_inject_linux;
       handle->setfilter_op = pcap_setfilter_linux;
       handle->setdirection_op = pcap_setdirection_linux;
       handle->set_datalink_op = NULL; /* can't change data link type */
       handle->getnonblock_op = pcap_getnonblock_fd;
       handle->setnonblock_op = pcap_setnonblock_fd;
       handle->stats_op = pcap_stats_linux;
       handle->close_op = pcap_close_linux;

       return handle;
    } while(0);
  
    fprintf(stderr, "epoll setting error\n");
    pcap_close_linux(handle);
    free(handle);
    return NULL;
}
....
static int
pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
{
 u_char   *bp;
 int   offset;
#ifdef HAVE_PF_PACKET_SOCKETS
 struct sockaddr_ll from;
 struct sll_header *hdrp;
#else
 struct sockaddr  from;
#endif
 socklen_t  fromlen;
 int   packet_len, caplen;
 struct pcap_pkthdr pcap_header;

 int n ; /* epoll returned count */
  
.... 중략 ....

 /* Receive a single packet from the kernel */

 bp = handle->buffer + handle->offset;
 do {
  /*
   * Has "pcap_breakloop()" been called?
   */
  if (handle->break_loop) {
   /*
    * Yes - clear the flag that indicates that it
    * has, and return -2 as an indication that we
    * were told to break out of the loop.
    */
   handle->break_loop = 0;
   return -2;
  }
  fromlen = sizeof(from);

  n = epoll_wait(epollfd, epoll_events, EPOLL_EVENTS, handle->md.timeout);
  if (0 >= n)
  {
   break ;
  }
  for ( int i = 0 ; i < n ; ++i )
  {
    if ( epoll_events[i] == handle->selectable_fd )
    {

       packet_len = recvfrom(
       handle->fd, bp + offset,
       handle->bufsize - offset, MSG_TRUNC,
      (struct sockaddr *) &from, &fromlen);
    }
 } while (packet_len == -1 && errno == EINTR);

 if ( n == 0 || (  n < 0 && errno == EINTR ) )
 {
  /* callback function must check packet_header, buffer_pointer is NULL. if they are NULL, it is timeout */
  callback(userdata, NULL, NULL);
  return 0;
 }

.... 중략 ....

static void pcap_close_linux( pcap_t *handle )
{
 struct pcap *p, *prevp;
 struct ifreq ifr;

.... 중략 ....

 if (handle->md.device != NULL)
  free(handle->md.device);
 handle->md.device = NULL;
 if (handle->selectable_fd > 0 ) /* 여긴 대충 대충 -ㅅ- */
 {
   close(epollfd);
 }
 pcap_close_common(handle);