Re: [libpcap][patch] appending to a capture

[Darren Reed <darren.reed () oracle com>]

On  3/06/11 05:24 PM, Guy Harris wrote:
> On Jun 3, 2011, at 3:13 PM, Darren Reed wrote:
>
>    
> > Because for every packet that is appended you need to do:
> > 1. open(2)
> > 2. read(2)
> > 3. seek(2)
> > 4. write(2)
> > 5. close(2)
> >      
> Really?
>
> Why can't you do
>
>         open(2)
>         read(2)
>         seek(2)
>         write(2)
>
> in pcap_dump_append(), and then just keep writing packets to the pcap_dumper_t you got back from pcap_dump_append()?
>    

Presumably because the way I read his description of it,
it sounded like the verification (matching of file header)
was done for each new packet added.

Darren

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.