On Sat, Jan 13, 2001 at 09:44:19PM +0200, Pekka Savola wrote:
> It'd appear that a lot of hooks for all of this are in place in
> pcap-linux.c, but the interface between pcap and tcpdump is missing them.
It's not a just a question of the interface, it's a question of the
capture file format; this would require that the capture file include
either the interface name in the header for every packet, or that it
include a header giving the interface names (and perhaps other
information, such as the link-layer type - when capturing with the "any"
device, there's only one capture device, and therefore only one capture
filte program, and therefore you have to use cooked mode, but one could
also imagine that, at some point, we might want to allow capturing on
multiple interfaces with *multiple* capture streams, in which case that
you wouldn't have that limitation) for all interfaces on which the
capture is being done.
I.e., this requires a capture file format change, in which case we might
want to think about other changes we'd want to make as well.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
