Thanks for all the info! I am off to go give these things a try.
Ethereal/tethereal has been a great tool for me here at work. Thanks
to all of you for what you do.
Regards,
Mike
-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Wednesday, October 19, 2005 2:32 AM
To: Ethereal user support
Subject: Re: [Ethereal-users] tethereal performance questions
Joe Elliott wrote:
> My pipe example with tcpdump does not work with tethereal as the
-r
> switch to read a file does not handle STDIN. It works fine with
tcpdump.
>
> Can the developers put the '-r -' functionality in?
Not very conveniently. Tcpdump reads fewer types of capture files than
does Tethereal; Tethereal's capture-file-reading library (the same one
as Ethereal) determines the file type (and some other characteristics of
the file) by trying to read the file multiple times. That's done by
seeking back to the beginning of the file and reading; that doesn't work
on pipes.
At some point the Ethereal/Tethereal library might do its own buffering,
rather than using the "standard I/O library" routines, and might do its
own uncompression, rather than using libz (libz doesn't, as far as I
know, provide enough access to the decompresser's internal state to
allow fast random access in compressed data streams). When that's done,
the library will probably also support rewinding to the beginning of a
pipe *IF* only one bufferful of data has been read (as there's no
seeking to be done, just going back to the beginning of the buffer).
There's no schedule for doing that; it would depend on the free time
available to developers (which is the case for just about every feature
the user base might want).
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users