Re: [tcpdump-workers] Multifile patch

2012-09-13 Thread Wesley Shields
On Thu, Sep 06, 2012 at 02:46:30PM -0400, Wesley Shields wrote: > On Mon, Sep 03, 2012 at 10:13:57PM -0400, Michael Richardson wrote: > > > > Wesley, is fopen("/dev/stdin") really the most portal way to > > get a reference to stdin? I'd have thought that doing: > > VFile=stdin; > > > > was t

Re: [tcpdump-workers] Multifile patch

2012-09-06 Thread Wesley Shields
On Mon, Sep 03, 2012 at 10:13:57PM -0400, Michael Richardson wrote: > > Wesley, is fopen("/dev/stdin") really the most portal way to > get a reference to stdin? I'd have thought that doing: > VFile=stdin; > > was the best way? I fixed this and your other comment about refactoring reading fr

Re: [tcpdump-workers] Multifile patch

2012-09-05 Thread David Laight
> > On windows you can't pass 'FILE *' into shared libraries, > > they are likely to have their own copies of the stdio > > libraries - with different FILE structures. > > (eg if one part is compiled with debug enabled). > > In this patch, the library into which VFile is being passed is called > "

Re: [tcpdump-workers] Multifile patch

2012-09-04 Thread Guy Harris
On Sep 4, 2012, at 3:11 AM, David Laight wrote: > On windows you can't pass 'FILE *' into shared libraries, > they are likely to have their own copies of the stdio > libraries - with different FILE structures. > (eg if one part is compiled with debug enabled). In this patch, the library into whi

Re: [tcpdump-workers] Multifile patch

2012-09-04 Thread David Laight
> On Sep 3, 2012, at 7:13 PM, Michael Richardson wrote: > > > Wesley, is fopen("/dev/stdin") really the most portal > > (Presumably "portable".) > > > way to get a reference to stein? > > Definitely not - it will probably work on most modern UN*Xes (Linux, > *BSD/OS X, and Solaris; I don't know

Re: [tcpdump-workers] Multifile patch

2012-09-04 Thread Gert Doering
Hi, On Mon, Sep 03, 2012 at 10:13:57PM -0400, Michael Richardson wrote: > Wesley, is fopen("/dev/stdin") really the most portal way to > get a reference to stdin? It's about the most complicated way, and guaranteed to be non-portable (no /dev/std* devices on AIX, for example). > I'd have thoug

Re: [tcpdump-workers] Multifile patch

2012-09-04 Thread Guy Harris
On Sep 3, 2012, at 7:13 PM, Michael Richardson wrote: > Wesley, is fopen("/dev/stdin") really the most portal (Presumably "portable".) > way to get a reference to stein? Definitely not - it will probably work on most modern UN*Xes (Linux, *BSD/OS X, and Solaris; I don't know about HP-UX or AI

Re: [tcpdump-workers] Multifile patch

2012-09-03 Thread Michael Richardson
Wesley, is fopen("/dev/stdin") really the most portal way to get a reference to stdin? I'd have thought that doing: VFile=stdin; was the best way? Other than that, I think your patch is the best way to implement this I'd like if we could also handle multiple -r files in exactly the same

Re: [tcpdump-workers] Multifile patch

2012-08-23 Thread Wesley Shields
On Thu, Aug 23, 2012 at 01:27:33PM -0400, Michael Richardson wrote: > > > "Wesley" == Wesley Shields writes: > >> Since pcap files have no end of file marker, and each file > >> has a header on it, do you look at the beginning of each packet, and > see > >> if there is a pcap mag

Re: [tcpdump-workers] Multifile patch

2012-08-23 Thread Michael Richardson
> "Wesley" == Wesley Shields writes: >> Since pcap files have no end of file marker, and each file >> has a header on it, do you look at the beginning of each packet, and see >> if there is a pcap magic number? Wesley> I'm not sure I'm parsing this right but... Wesley> I

Re: [tcpdump-workers] Multifile patch

2012-08-21 Thread Wesley Shields
On Tue, Aug 21, 2012 at 08:36:12PM -0400, Michael Richardson wrote: > > Wesley, it seems like a good idea. > I can't look at your patch from the cottage, since I squirt out bits > only once a day by walking down the road to where there is some wifi. No worries, I'm in no rush on this. Enjoy your

Re: [tcpdump-workers] Multifile patch

2012-08-21 Thread Michael Richardson
Wesley, it seems like a good idea. I can't look at your patch from the cottage, since I squirt out bits only once a day by walking down the road to where there is some wifi. Since pcap files have no end of file marker, and each file has a header on it, do you look at the beginning of each packet,

[tcpdump-workers] Multifile patch

2012-08-19 Thread Wesley Shields
I've added support to tcpdump that lets you do things like: find /pcaps -type f | tcpdump -V - -w out.pcap or: find /pcaps -type f > ~/pcaps; tcpdump -V ~/pcaps -w out.pcap When writing out to a file it makes sure the DLT of every subsequent file matches the DLT of the first file. It's in a fo