Wireshark · Ethereal-dev: Re: [Ethereal-dev] mergecap from fifos

[Richard van der Hoff <richardv@xxxxxxxxxxxxx>]

Richard van der Hoff wrote:
> Hi,
>
> The attached patch and replacements of wiretap/file_wrappers.{c,h} 
> address the can't-mergecap-from-fifos problem by adding a layer of 
> buffering to capture file access in wiretap.
>
> This trick only works for capture file formats which can be read 
> incrementally in a single pass, but since that includes libpcap, I've 
> found it to be adequate for my needs.
>
> I've found it works pretty well for me, but please do share any comments.
Does anyone have any further comments on this? Given how long I've 
*really, really* wanted this feature, I can't believe I'm alone.

In case anyone missed the relevance: the point of this is that you can 
do two live captures at once (for instance, from different interfaces 
with finer control than "all", or even from different machines).

Cheers

Richard

--
Richard van der Hoff <richardv@xxxxxxxxxxxxx>
Systems Analyst
Tel: +44 (0) 845 666 7778
http://www.mxtelecom.com