On Wed, Jun 04, 2003 at 12:46:28AM -0700, Ben Greear wrote:
Is there any fool-proof way to determine if a packet was coming into the interface v/s going out the interface when looking at a libpcap dump file?
No.
It is not always the case that the packet capture mechanism used by libpcap even supplies that information; the libpcap capture file format thus doesn't include that information.
Guess it's time to re-invent the wheel then...
Thanks, Ben
-- Ben Greear <[EMAIL PROTECTED]> <Ben_Greear AT excite.com> President of Candela Technologies Inc http://www.candelatech.com ScryMUD: http://scry.wanfear.com http://scry.wanfear.com/~greear
- This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
