Re: Question about savefile format

[Guy Harris <guy () alum mit edu>]

Milosz Marian Hulboj wrote:

> What I meant was to store the captured packets in the blocks of fixed size 
> (possibly wasting some of the storage space in case of small packets, but 
> gaining in case one wishes to do random access). So to access packet $n$ I 
> would have to look at the offset = header + n*block_size.

As I indicated, the current file format does not have any blocks of 
fixed size, so there are no blocks of fixed size into which you can 
store packets - the packet blocks have two size values, but they're not 
the size of the block, they're the size of the packet on the network and 
the size of captured data from the packet, so any padding you'd add to 
make the blocks fixed-size would make the packet look bigger than it is.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.