Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Jesse Kempf
Michael Richardson wrote: Only... -P is used somewhere else, in another patch, I think. We gotta get 4.0 out, with long options... Fair enough. But the question is less "what do we call it?" and more "does this functionality get into tcpdump?". Cheers, -Jesse ---

Re: [tcpdump-workers] Question about savefile format

2008-04-02 Thread Guy Harris
On Apr 1, 2008, at 2:03 AM, Milosz Marian Hulboj wrote: I would like to know whether it is possible with the current pcap format to store the captured packets in the fixed length blocks in the file. What "fixed length blocks" are you referring to? The current file format has 1)

Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Jesse Kempf
On Apr 2, 2008, at 11:01 AM, Jesse Kempf wrote: On Apr 2, 2008, at 10:08 AM, Milosz Marian Hulboj wrote: On Wednesday 02 April 2008, Jesse Kempf wrote: Hi, So tcpdump tends to jam up the terminal a bit when you try to dump on a saturated gigabit link. I've added a -P option to tcpdump that

Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Jesse Kempf
On Apr 2, 2008, at 10:08 AM, Milosz Marian Hulboj wrote: On Wednesday 02 April 2008, Jesse Kempf wrote: Hi, So tcpdump tends to jam up the terminal a bit when you try to dump on a saturated gigabit link. I've added a -P option to tcpdump that lets you specify a probability for tcpdump to p

Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Jesse Kempf
On Apr 2, 2008, at 6:41 AM, Bruce M Simpson wrote: Jesse Kempf wrote: Hi, So tcpdump tends to jam up the terminal a bit when you try to dump on a saturated gigabit link. I've added a -P option to tcpdump that lets you specify a probability for tcpdump to print each packet. It uses drand48

Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Ken Bantoft
Now that CVS is back, I'll have a beta out tomorrow... and weekly Thursday-ish Snapshots until everyone's happy enough for 4.0 final. Ken On Wed, 2 Apr 2008, Michael Richardson wrote: > > Only... -P is used somewhere else, in another patch, I think. > We gotta get 4.0 out, with long options.

Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Milosz Marian Hulboj
On Wednesday 02 April 2008, Jesse Kempf wrote: > Hi, > So tcpdump tends to jam up the terminal a bit when you try to dump on a > saturated gigabit link. I've added a -P option to tcpdump that lets you > specify a probability for tcpdump to print each packet. It uses > drand48() to figure out whe

Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Michael Richardson
Only... -P is used somewhere else, in another patch, I think. We gotta get 4.0 out, with long options... - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] [Patch] tcpdump probabilistic sampling

2008-04-02 Thread Bruce M Simpson
Jesse Kempf wrote: Hi, So tcpdump tends to jam up the terminal a bit when you try to dump on a saturated gigabit link. I've added a -P option to tcpdump that lets you specify a probability for tcpdump to print each packet. It uses drand48() to figure out whether each packet captured should be