On Wed, Jun 1, 2011 at 11:13 AM, Michael Richardson <m...@sandelman.ca> wrote: > Yeah, I'd rather that we have a good set of pcap manipulation tools. > Maybe we just need better pointers to mergecap and editcap?
I don't see extensions to libpcap and a good set of tools as an either/or thing. I'd be pretty happy to see the capabilities of tools such as mergecap, editcap, and tcpslice presented as C callable APIs. Its possible to shell out to do pcap manipulations, but its often more useful to bind C APIs into your working language, allowing you to combine effects in interesting ways that might not be forseen by the command line tools. If not in libpcap, maybe libcaptool? Cheers, Sam - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
