Re: What is the main reason in absent append

[Stephen Donnelly <stephen () endace com>]

On Thu, 2006-02-16 at 20:17 +0300, Mikhail Manuylov wrote:
> Hi there,
>
> All I wonder is why tcpdump still hasn't any binary dump append feature.

The biggest problem I imagine is that the resulting file would have only
one header block, so the configuration of the capture for the appended
records would have to be the same as for the original file.

I'm not sure how you could check for or enforce this?

The 'NTAR' file format intended for pcap-ng supports directly appending
capture files together, allowing new header blocks to redescribe the
interfaces and capture parameters.

Stephen.
-- 
-----------------------------------------------------------------------
    Stephen Donnelly BCMS PhD           email: sfd () endace com
    Endace Technology Ltd               phone: +64 7 839 0540
    Hamilton, New Zealand               cell:  +64 21 1104378
-----------------------------------------------------------------------

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.