Can tcpdump be made so it read's once and write twice? This would limit the number of times tcpdump needs to copy the packet from the wire to write two files (actually one file and one FIFO). Actually, if I just want to read the data from the wire and write to file(s) (after filtering on BPF filter provided), does tcpdump's parsers slow it down in any way or would I be better off writing a leaner tcpdump?
Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com
pgp00000.pgp
Description: PGP signature
