Re: [tcpdump-workers] using a database to store packets

2004-11-29 Thread MAURICIOMANENTS
Daniel Lawson wrote: > >>option 2: > >>You want to filter out specific traffic before storing a capture to disk. > > > >option 2 is closer to what I want, but it's not what I want. > >I want to remove specific traffic WHILE storing a capture to disk. > > Ok, that makes more sense then. I also gues

Re: [tcpdump-workers] using a database to store packets

2004-11-29 Thread Daniel Lawson
option 2: You want to filter out specific traffic before storing a capture to disk. option 2 is closer to what I want, but it's not what I want. I want to remove specific traffic WHILE storing a capture to disk. Ok, that makes more sense then. I also guess you don't know ahead of time wha

Re: [tcpdump-workers] using a database to store packets

2004-11-29 Thread Aaron Turner
Uh, I'm sure this is obvious, but why not just use a bpf filter to restrict what packets get written? At least my experiances with SQL databases is that the insert speed is not going to be fast enough with anything but the lightest loaded network. -- Aaron Turner http://synfin.net/ They that c

Re: [tcpdump-workers] using a database to store packets

2004-11-29 Thread MAURICIOMANENTS
Daniel Lawson wrote: > >The problem with libpcap format is that I can't read the file in > >realtime, nor delete packets. > > What do you mean by 'delete packets'. Are you wanting to actually remove > packets off the wire, or just from an offline storage of your capture? I want to remove packets f

Re: [tcpdump-workers] keyword outbound with ppp-2.4.3

2004-11-29 Thread Petersen . Stefan
OK, thanks for that patch, I will take that update the ppp-code like this. Do you know, if the ppp people be aware of this? I will post this to the Gentoo forum, and see if this will become an official patch. Thanks for your help. - This is the tcpdump-workers list. Visit https://lists.

Re: [tcpdump-workers] keyword outbound with ppp-2.4.3

2004-11-29 Thread Karsten Keil
On Mon, Nov 29, 2004 at 11:44:12AM +0100, [EMAIL PROTECTED] wrote: > > > > > Hello, > > I have tried to use the active-filter option with ppp. > I hvae teaken a daily snapshot yesterday of libpcap, but there is an > errormsg when starting ppp: > > error in active-filter expression: inbound/ou

[tcpdump-workers] keyword outbound with ppp-2.4.3

2004-11-29 Thread Petersen . Stefan
Hello, I have tried to use the active-filter option with ppp. I hvae teaken a daily snapshot yesterday of libpcap, but there is an errormsg when starting ppp: error in active-filter expression: inbound/outbound not supported on linktype 9_ The option in my peers-file looks like: active-filt