Re: [tcpdump-workers] --immediate-mode in combination with -U

2019-09-24 Thread Michal Ruprich
Any thoughts on this? On 9/16/19 2:33 PM, Michal Ruprich wrote: > Hi, > > would you consider adding a mention of the --immediate-mode to the -U > option in the manpage? For someone who is not familiar with how the > packets are buffered before they are passed to tcpdump, it might not be > obvious

Re: [tcpdump-workers] [pcap-ng-format] sane maximum length for block_length

2019-09-24 Thread Guy Harris
On Sep 20, 2019, at 2:02 PM, Michael Richardson wrote: > Guy Harris wrote: >> Currently, Wireshark's pcapng reading code imposes a block size limit >> for all blocks: > >> enough that * the resulting block size would be less than the previous >> 16 MiB limit. */ #define MAX_BLOCK_SIZE (MIN_EPB