Re: [tcpdump-workers] deduct local IP address from cap-file

2010-05-03 Thread Gert Doering
Hi, On Fri, Apr 30, 2010 at 02:38:59PM -0700, Guy Harris wrote: > if they're received by that host, and the destination address isn't a > broadcast or multicast address, see what the destination address is; ... and to nitpick: if "that host" is not a router and is just forwarding this pack

Re: [tcpdump-workers] estimate #packets in pcap file

2010-05-03 Thread Guy Harris
On Apr 30, 2010, at 5:15 PM, Andrej van der Zee wrote: > I am looking for way to estimate the number of packages in a pcap file > without traversing throu all packages with pcap_loop(). It does noet > have to be precise, just an estimate. Is there a way? *IF* you have an idea what the average pa