tcpdump mailing list archives
Re: Question about savefile format
From: Guy Harris <guy () alum mit edu>
Date: Thu, 03 Apr 2008 03:07:48 -0700
Milosz Marian Hulboj wrote:
What I meant was to store the captured packets in the blocks of fixed size (possibly wasting some of the storage space in case of small packets, but gaining in case one wishes to do random access). So to access packet $n$ I would have to look at the offset = header + n*block_size.
As I indicated, the current file format does not have any blocks of fixed size, so there are no blocks of fixed size into which you can store packets - the packet blocks have two size values, but they're not the size of the block, they're the size of the packet on the network and the size of captured data from the packet, so any padding you'd add to make the blocks fixed-size would make the packet look bigger than it is.
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Question about savefile format Milosz Marian Hulboj (Apr 01)
- Re: Question about savefile format Guy Harris (Apr 02)
- Re: Question about savefile format Milosz Marian Hulboj (Apr 03)
- Re: Question about savefile format Guy Harris (Apr 03)
- tcpdump 4.0.0rc1 and libpcap 1.0.0rc1 available Ken Bantoft (Apr 03)
- Re: Question about savefile format Milosz Marian Hulboj (Apr 03)
- Re: Question about savefile format Guy Harris (Apr 02)