On Thu, 2006-02-16 at 12:42 -0800, Guy Harris wrote: > > Require read and write access for appending, open for reading and > writing, read the header, make sure the link-layer type and snapshot > length are the same (and fail if they're not), and then seek to the > end and start writing.
And check whether the last packet has indeed been written out in its entirety, otherwise pcap header corruption will occur at the append spot. I'm really looking forward to seeing this in pcap itself. If you need it today, use pcapnav: http://netdude.sourceforge.net/doco/libpcapnav/pcapnav-pcapnav.html#PCAPNAV-DUMP-OPEN Cheers, Christian. -- ________________________________________________________________________ http://www.cl.cam.ac.uk/~cpk25 http://www.whoop.org - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
