On Sat, Mar 22, 2003 at 12:22:12PM +0800, Michael Boman wrote: > Can tcpdump be made so it read's once and write twice? This would > limit the number of times tcpdump needs to copy the packet from the > wire to write two files (actually one file and one FIFO).
Tcpdump could probably be made to allow multiple "-w" flags, so that you could specify multiple output files. > Actually, > if I just want to read the data from the wire and write to file(s) > (after filtering on BPF filter provided), does tcpdump's parsers slow > it down in any way No, because they're not even run. If you run tcpdump with "-w", it just reads packets and writes them out, without dissecting the contents of the packet.
pgp00000.pgp
Description: PGP signature
