Oh, I forgot. Another useful thing to have is an option for the packet block where one would store a reasonably collission-safe 8-byte hash of the packet data.
This would make it much easier to compare two different capture files to see where packets are missing etc. - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
