Matthew Hall <mhall at mhcomputing.net> writes: >> The pcap file format contains a header in front of each packet, which is >> extremely simple. But it has a timestamp (which uses 32 bit for tv_sec and >> tv_usec in files), so it needs to be considered how to handle this >> efficiently. > > I already wrote some C code for generating the original pcap format files a > while ago which I think could be donated. For the timestamps to work at > highest efficiency we'd need to run an rte_timer every X microseconds that > updates a global volatile copy of tv_sec and tv_usec. > > Or make some code that calculates the offset of rte_rdtsc from 01 January > 1970 > 00:00:00 UTC and uses TSC value to generate the right tv_sec and tv_usec > would > also work fine.
Why not just use libpcap to write out pcap files? I bet it does a better job that any of us will ;) It's BSD licensed, so there should be no issues with linking against it (DPDK currently does for the pcap PMD), and it supports both pcap and pcap-ng (although -ng support may not be 100%, I expect it will get better). No need to donate to the cause on this one, I think :) The issues surrounding tcpdump are, imo, ones of library/application workflow. HOW does the user enable tcpdump-like support? The current option is to start up with a pcap PMD configured, capture to a file for a bit, then stop. I think the issues being discussed are what other options to give the user. Then again, I may have my signals crossed somewhere. -Aaron > Matthew.