>>That could be done by adding a "pcap_dump_flush()" call, to force the >>stdio buffer to be flushed, and have tcpdump's main loop be a loop using >>"pcap_dispatch()" rather than just being "pcap_loop()", and have it do >>the "pcap_dump_flush()" call after "pcap_dispatch()" returns. > >okay...a patch to tcpdump without intruding into/breaking the libpcap >api is good.
new tactic. instead of mucking with the subtle logic of replacing pcap_loop() with pcap_dispatch(), we put calls to pcap_dump_flush() into dump_packet_and_trunc() and dump_packet(). now to make the link layer stuff dump... -- |-----< "CODE WARRIOR" >-----| [EMAIL PROTECTED] * "ah! i see you have the internet [EMAIL PROTECTED] (Andrew Brown) that goes *ping*!" [EMAIL PROTECTED] * "information is power -- share the wealth." - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
