On Fri, Jun 3, 2011 at 9:49 PM, Darren Reed <[email protected]> wrote: > On 3/06/11 05:24 PM, Guy Harris wrote: >> >> On Jun 3, 2011, at 3:13 PM, Darren Reed wrote: >> >> >>> >>> Because for every packet that is appended you need to do: >>> 1. open(2) >>> 2. read(2) >>> 3. seek(2) >>> 4. write(2) >>> 5. close(2) >>> >> >> Really? >> >> Why can't you do >> >> open(2) >> read(2) >> seek(2) >> write(2) >> >> in pcap_dump_append(), and then just keep writing packets to the >> pcap_dumper_t you got back from pcap_dump_append()? >> > > Presumably because the way I read his description of it, > it sounded like the verification (matching of file header) > was done for each new packet added. >
I see; sorry if that was misleading. I agree that pcap_dump_reopen() is probably a better name for the function, but yes, the idea is that this function is only called once when one wants to append to a capture file. -Mark - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
