Re: [libpcap][patch] appending to a capture

[Guy Harris <guy () alum mit edu>]

On Jun 3, 2011, at 3:13 PM, Darren Reed wrote:

> Because for every packet that is appended you need to do:
> 1. open(2)
> 2. read(2)
> 3. seek(2)
> 4. write(2)
> 5. close(2)

Really?

Why can't you do

        open(2)
        read(2)
        seek(2)
        write(2)

in pcap_dump_append(), and then just keep writing packets to the pcap_dumper_t you got back from pcap_dump_append()?

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.