Re: [tcpdump-workers] Proposed new pcap format

2004-04-12 Thread Ronnie Sahlberg
- Original Message - From: Loris Degioanni Sent: Monday, April 12, 2004 2:56 PM Subject: Re: [tcpdump-workers] Proposed new pcap format I'd prefer a general flag field, which would include a direction indication (which might also include, for received packets, an indication of

Re: [tcpdump-workers] bpf/pcap performance

2004-04-12 Thread Michael Richardson
Darren == Darren Reed [EMAIL PROTECTED] writes: Darren In some email I received from Guy Harris, sie wrote: On Sun, Apr 11, 2004 at 03:15:30AM +1000, Darren Reed wrote: And there's also BPF_MAXBUFFERSIZE. I see pcap_getbuff() as being essential to getting code to work

Re: [tcpdump-workers] bpf/pcap performance

2004-04-12 Thread Guy Harris
On Apr 12, 2004, at 5:07 PM, Guy Harris wrote: ...which would require that pcap_pkthdr be changed to begin with a struct pcap_timeval. If it's OK to, on platforms where, for example, ts_sec is 64 bits, break binary compatibility with applications dynamically linked with libpcap, we could do