Michael Richardson wrote:
> I'm unclear if you want to run many rules (filter1 OR filter2 OR filter3) on
> a single interface, or you want to run many pcap filters on different
> interfaces.
One interface. 1000's of filter rules.
> I think that Guy's answer suggesting that your pcap library wa
I'm unclear if you want to run many rules (filter1 OR filter2 OR filter3) on
a single interface, or you want to run many pcap filters on different
interfaces.
> There's pcap_open_offline() for files. There's no
> interface which says "here's a packet, run the rule against it".
I think that Guy'
List,
is anybody else willing to review this pull request?
https://github.com/the-tcpdump-group/tcpdump/pull/324
These are quite small decoders, but I'm not familiar with the field and quite
busy until the weekend.
--
Denis Ovsienko
___
tcpdump-