Ed Maste wrote:
Your program wouldn't be processing old captured data. You have tcpdump output libpcap format data to stdout, in realtime.
Note that there's currently no option in tcpdump to cause the standard output to be flushed at the end of a packet (or a batch of packets) when capturing with "-w -", so the last packet in a batch might not be delivered as soon as it arrives.
"-l" could perhaps be hijacked for that purpose, although it's a bit counter-intuitive to have "l"ine-buffering refer to something when the output isn't lines of text.
Tethereal always flushes the standard output after processing a batch of packets if it's writing to a pipe in "-w" mode. If the typical case of piping from tcpdump/Tethereal is piping to a process that wants packets as soon as they arrive, rather than to a process that's manipulating the sequence of packets and writing it to a file that's not going to be looked at until the capture is done, that might be the right thing to do.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.