Re: TCPDump is truncating output file if it already exists..

[Guy Harris <gharris () sonic net>]

On Sun, Apr 13, 2003 at 04:52:31PM +0800, Michael Boman wrote:
> TCPDump currently truncate (overwrite) the output file if it already
> exists, is there any way to make it append to the output file if it
> already exists?

Note that "appending to" a libpcap-format file doesn't mean "opening it
without truncating it, seeking to the end, and writing", it means
"opening it, checking to make sure the link-layer type in the file is
the same as the link-layer type you're appending, failing if it isn't,
and otherwise seeking to the end and starting to write packet data" -
you can only have one file header in a libpcap-format file, at the
beginning.

It is probably not impossible to add a "pcap_dump_open_append()"
function to libpcap that would do that, and, given that function, one
could probably add a new command-line flag to get tcpdump to append to a
capture file rather than truncating and overwriting it.

Attachment: _bin
Description: