Cobra
7442dc24dd
With multiprocessing fork, threads are not inherited. The parent's CaptureBus reader thread runs in the parent but module subprocesses subscribe AFTER fork, so their SubscriberQueue entries are added to a child-local copy of _subscribers that the parent reader never sees. Fix: reset and restart CaptureBus in each module subprocess so it has its own reader thread on the inherited AF_PACKET socket. Each module gets independent packet delivery. Linux AF_PACKET allows multiple readers on the same interface.