Hi Bill,
I appreciate your ideas. I am the root of the system. As you say, it is not possible to catch packets simultaneously on more than one interface or all interfaces. But there are tools like tcpdump. tcpdump with -i option of 'any' can catch packets on all interfaces. Even the Pcap library in C supports 'any' value for dev paramater for open_live method. I am guessing why Net::Pcap library doesn't provide option of 'any' for open_live method. I thought Net::PCap is exact equivalent to Pcap library. As you say, one of the ways I could solve this problem is to catch packets separately from 2 interfaces and then merge the files by timestamp values in to a single value. Is there any other way?
You must not be on Solaris because tcpdump doesnt/won't captyure all interfaces simultaneously. I dont know of another way :)
Reason (from tcpdump man page) -
-i Listen on interface. If unspecified, tcpdump searches
the system interface list for the lowest numbered, con-
figured up interface (excluding loopback). Ties are
broken by choosing the earliest match. On Linux systems with 2.2 or later kernels, an inter-
face argument of ``any'' can be used to capture packets
from all interfaces. Note that captures on the ``any''
device will not be done in promiscuous mode.I believe my "issue" at this point is why merge two separate interface data captures into a single file?
--
__Sx__________________________________________
http://youve-reached-the.endoftheinternet.org/
-- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] <http://learn.perl.org/> <http://learn.perl.org/first-response>
