Re: Read once, write twice?

[Guy Harris <gharris () sonic net>]

On Sat, Mar 22, 2003 at 12:22:12PM +0800, Michael Boman wrote:
> Can tcpdump be made so it read's once and write twice? This would
> limit the number of times tcpdump needs to copy the packet from the
> wire to write two files (actually one file and one FIFO).

Tcpdump could probably be made to allow multiple "-w" flags, so that you
could specify multiple output files.

> Actually,
> if I just want to read the data from the wire and write to file(s)
> (after filtering on BPF filter provided), does tcpdump's parsers slow
> it down in any way

No, because they're not even run.  If you run tcpdump with "-w", it just
reads packets and writes them out, without dissecting the contents of
the packet.

Attachment: _bin
Description: