Read once, write twice?

[Michael Boman <michael.boman () securecirt com>]

Can tcpdump be made so it read's once and write twice? This would
limit the number of times tcpdump needs to copy the packet from the
wire to write two files (actually one file and one FIFO). Actually,
if I just want to read the data from the wire and write to file(s)
(after filtering on BPF filter provided), does tcpdump's parsers slow
it down in any way or would I be better off writing a leaner tcpdump?

Best regards
 Michael Boman

-- 
Michael Boman
Security Architect, SecureCiRT Pte Ltd
http://www.securecirt.com

Attachment: _bin
Description: