Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] dumpcap performance?

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 22 Feb 2013 16:39:14 -0500
Anders Broman wrote:
Hi,
Would something like this be more efficient?

Basically you're proposing building one bigger buffer for writing rather than doing several smaller writes?

My experience would say no: memcpy()s should be avoided whenever possible. Admittedly my experience does not include a lot of file I/O but I would think/hope the OS would do a good job of buffering smaller writes into larger I/Os.

Another way to solve the many-small-writes problem (if it is a problem) would be to use writev().