Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] PATCH - Allow editcap to report # of packets infile

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Olivier Biot" <ethereal@xxxxxxxxxx>
Date: Tue, 27 Jul 2004 21:38:24 +0200
From: Ian Schorr
|
|
| Guy Harris wrote:
|
| >On Tue, Jul 27, 2004 at 01:40:13AM -0400, Ian Schorr wrote:
| >
| >
| >>Allows user to throw a -c command-line option that instructs
editcap to
| >>return the number of packets in a file to stdout.
| >
| >The only code path it shares with the rest of editcap is the
argument
| >parsing;
| >
| It's only 39 lines, but since editcap is only 468 lines (including
| comments) it's a significant percentage =)
|
| >does it belong in editcap, or does it belong in another
| >program, say "packet_count"?
| >
| I considered that when writing.  I suppose it depends on how much we
| want to avoid having a large number of single-purposed executables
| versus building tools with feature bloat/conflicting features.  In
this
| case I didn't feel the feature deserved spinning off a whole new
tool,
| and that out of the existing tools it made sense to put it in
editcap
| (I've felt that editcap is the tool for massaging frames in a
capture,
| building a packet count made sense to me).
|
| ...Or if someone feels strongly otherwise I'll move it into a
separate tool.

I think one interesting tool is a tool which acts like the *NIX "file"
command which guesses the file type. How about calling this new tool
(which only READS capture files) cap_info, cap_type or cap_file? The
code you wrote fits best in such a new tool.

| If I get some time this week I'd also like to re-build a "splitcap"
| tool, which I believe DOES make sense to build separately.

Go ahead!

Regards,

Olivier