Re: Libpcap timeout settings in tcpdump - too long when printing to a terminal?

[Michael Richardson <mcr () sandelman ca>]

Guy Harris <guy () alum mit edu> wrote:
    > The longer timeout can reduce capturing overhead, and if you're
    > capturing a high volume of traffic to a file, it's probably the right
    > timeout to have.  If, however, you're printing packets to the console,
    > you're probably doomed if it's a high volume of traffic, and may want
    > less of a delay if it's a low volume of traffic.

    > Should we reduce the timeout if -w isn't specified - or do so if -w
    > isn't specified *and* if we're outputting to a terminal (isatty(1)
    > returns a non-zero value)?  Should we use immediate mode if libpcap

Yes, I think that -w not specified, and isatty()==1.

    > supports it?  Should we offer a command-line option to override the
    > default?  (I'd prefer to have the default be appropriate for most
    > cases, which may mean a different default if printing packets or if

I think that we should be able to override things.
I had hoped to spend time on tcpdump over the holidays, but IETF nomcom work
ate my brain.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     mcr () sandelman ca  http://www.sandelman.ca/        |   ruby on rails    [ 
        

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers