Re: Recording slow scans

[Vern Paxson <vern () ee lbl gov>]

> I did code up the changes I mentioned previously (twiddling libpcap(3)
> and tcpdump(8) to accept multiple filters and output the results to multiple
> files).  When I have a few more spare cycles, I'll document the changes
> and submit them to the libpcap/tcpdump maintainers.  I have no idea
> how receptive said maintainers are to unsolicited changes, so I have
> no idea whether or not the changes are likely to make it into future
> releases.

We get unsolicited changes fairly often.  Whether they're incorporated
depends on how well IOHO they fit into the general design.  I've been
meaning to write something similar to what you describe, but as a
separate libpcap tool rather than folding it into tcpdump.  Our general
approach is to encourage separate libpcap utilities when possible, and
this one seems to fit into that.

                Vern