Re: What is the main reason in absent append

[Christian Kreibich <christian () whoop org>]

On Thu, 2006-02-16 at 12:42 -0800, Guy Harris wrote:
> Require read and write access for appending, open for reading and  
> writing, read the header, make sure the link-layer type and snapshot  
> length are the same (and fail if they're not), and then seek to the  
> end and start writing.

And check whether the last packet has indeed been written out in its
entirety, otherwise pcap header corruption will occur at the append
spot.

I'm really looking forward to seeing this in pcap itself. If you need it
today, use pcapnav:

http://netdude.sourceforge.net/doco/libpcapnav/pcapnav-pcapnav.html#PCAPNAV-DUMP-OPEN

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.