Re: buffering with -w in tcpdump

[Guy Harris <guy () alum mit edu>]

On Jan 27, 2004, at 2:34 AM, Darren Reed wrote:

> Is there any way to reduce the amount of buffering tcpdump does
> for -w ?  like get it to flush every second or packet or every
> 10k or...just not the way it defaults to :)

It defaults to "leave it up to the standard I/O library", which means 
that writes to the file occur when a buffer (probably 4K or 8K on most 
systems) fills and when the file is closed.

There's no option to tcpdump to change that, so...

> Or should I go cut some code ? :)

...you'd have to do that.

Libpcap 0.8 and later have a "pcap_dump_file()" function that takes a 
"pcap_dumper_t *" as an argument and returns the "FILE *" associated 
with it; you could use that to get the handle on which to do an 
"fflush()".

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe