Re: [PATCH] various fix for usb sniffing

[Guy Harris <guy () alum mit edu>]

Abeni Paolo wrote:

> Most notably the byte alignment of header contained in each usb
> 'packet' is enforced to be little endian (currently is in host byte
> order and this give some issue). This requires to disable memory mapped
> access.

Is there a significant performance improvement from memory-mapped 
access?  ("Significant" meaning "large" and "makes a difference when 
capturing traffic" - which might be happening when a CPU-intensive app 
is running on the machine.)

If so, then, while part of the packet data being in the byte order of 
the machine on which the capture is being done is not ideal:

	1) the host reading a capture file can determine the byte order of the 
host on which the capture was done, and the code in libpcap and 
Wireshark to read libpcap-format capture files could byte-swap the 
fields if necessary after reading the data in;

	2) there's already a header with that problem, namely the Prism header 
for 802.11.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.