Re: [tcpdump-workers] [libpcap][patch] appending to a capture

2011-06-01 Thread Michael Richardson
> "Sam" == Sam Roberts writes: >> Yeah, I'd rather that we have a good set of pcap manipulation >> tools. Maybe we just need better pointers to mergecap and >> editcap? Sam> I don't see extensions to libpcap and a good set of tools as an Sam> either/or thing. Sam> I

Re: [tcpdump-workers] [libpcap][patch] appending to a capture

2011-06-01 Thread Sam Roberts
On Wed, Jun 1, 2011 at 11:13 AM, Michael Richardson wrote: > Yeah, I'd rather that we have a good set of pcap manipulation tools. > Maybe we just need better pointers to mergecap and editcap? I don't see extensions to libpcap and a good set of tools as an either/or thing. I'd be pretty happy to

Re: [tcpdump-workers] [libpcap][patch] appending to a capture

2011-06-01 Thread Michael Richardson
Yeah, I'd rather that we have a good set of pcap manipulation tools. Maybe we just need better pointers to mergecap and editcap? -- ] He who is tired of Weird Al is tired of life! | firewalls [ ] Michael Richardson, Sandelman Software Works, Ottawa, ON|net architect[ ] m.

Re: [tcpdump-workers] [libpcap][patch] appending to a capture

2011-06-01 Thread Gerald Combs
On 6/1/11 8:10 AM, Mark Johnston wrote: > Hi Darren, > > On Tue, May 31, 2011 at 03:53:22PM -0700, Darren Reed wrote: > >> You might be better off spending some time working >> on additions to editcap that include concatenating >> two or more pcap files. > > Shouldn't a function that manipulates

Re: [tcpdump-workers] [libpcap][patch] appending to a capture

2011-06-01 Thread Mark Johnston
Hi Darren, On Tue, May 31, 2011 at 03:53:22PM -0700, Darren Reed wrote: > Hi Mark, > > I must admit that I don't see the point of this patch. > > A pcap data file, with packets in it, is something that > I would create using tcpdump over a specific period > of time. The data file is thus associa

[tcpdump-workers] Re: Re: [tcpdump-workers] libpcap1.1.1 truncates UDP payload, ring buffer problem?

2011-06-01 Thread mold2010
I tried libpcap1.1.1 release libpcap_1_1rel0 from https://github.com/mcr/libpcap. But found the same issue. Where can I get the 1.2 branch? Is it git hub: libpcap? I do not know if it is a Suse problem. I have a plan to try Redhat ES5.4 to see if there is still this problem. 在2011-06-01,guy发

Re: [tcpdump-workers] [libpcap][patch] appending to a capture

2011-06-01 Thread rixed
In defense of the OP, I must say I like the idea of a pcap_dump_append(). Your arguments against it are a lot more valid with regard to the tcpdump tool, for which an "--append" parameter seams dubious, than for the libpcap itself which can be used by many different programs for many different pur