On Jan 27, 2004, at 2:34 AM, Darren Reed wrote:
Is there any way to reduce the amount of buffering tcpdump does for -w ? like get it to flush every second or packet or every 10k or...just not the way it defaults to :)
It defaults to "leave it up to the standard I/O library", which means that writes to the file occur when a buffer (probably 4K or 8K on most systems) fills and when the file is closed.
There's no option to tcpdump to change that, so...
Or should I go cut some code ? :)
...you'd have to do that.
Libpcap 0.8 and later have a "pcap_dump_file()" function that takes a "pcap_dumper_t *" as an argument and returns the "FILE *" associated with it; you could use that to get the handle on which to do an "fflush()".
- This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
