The actual PR needs some cleanup/rebasing, but before doing that it was pointed 
out that soliciting feedback would be a good idea. PR here: 
https://github.com/the-tcpdump-group/tcpdump/pull/684


Motivation on our end was termination of captures after short periods of time 
-- say, grabbing 50ms of packets -- on high rate interfaces. The OS doesn't 
have enough insight into when the capture actually starts to get enough 
granularity in termination. The implementation here measures using the packet 
timestamps, starting with the first packet seen.


This feature was also requested here: 
https://github.com/the-tcpdump-group/tcpdump/issues/338


Thanks/Greg

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

Reply via email to