Re: gzip and tcpdump...

[Matt Bing <mbing () nfr net>]

Guy Harris said:
> On Wed, Feb 26, 2003 at 11:34:53PM +1100, Darren Reed wrote:
> > What you're looking for yere is:
> >
> > tcpdump -w - | gzip -c > foo.tcpdump.gz
>
> ...although if you ^C out of the tcpdump run, it also ^C's out of the
> gzip run, and, at least the one time I tried that, the resulting gzipped
> file was corrupt.

True, but in my opinion, I'd rather not see the pcap interface bloated
to support libz. Adding another function means applications have to
support it too. 

-- 
Matt Bing
NFR Security
Rapid Response Team
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe