In defense of the OP, I must say I like the idea of a pcap_dump_append(). Your arguments against it are a lot more valid with regard to the tcpdump tool, for which an "--append" parameter seams dubious, than for the libpcap itself which can be used by many different programs for many different purposes, and editcap may not be an option here.
> That said, I can also imagine people using this function > and running into huge performance problems. I fail to imagine any performance problems. Any examples please? - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
