[Anders Broman <a.broman@xxxxxxxxxxxx>]

Hi,
Would something like this be more efficient?

Index: pcapio.c
===================================================================
--- pcapio.c	(revision 47793)
+++ pcapio.c	(working copy)
@@ -602,6 +602,8 @@
         guint64 timestamp;
         gboolean have_options = FALSE;
         const guint32 padding = 0;
+		guint8 buff[4096];
+		int i = 0;
 
         block_total_length = (guint32)(sizeof(struct epb) +
                                        ADD_PADDING(caplen) +
@@ -628,6 +630,46 @@
         epb.timestamp_low = (guint32)(timestamp & 0xffffffff);
         epb.captured_len = caplen;
         epb.packet_len = len;
+		if(block_total_length<4096){
+			int epb_len= sizeof(struct epb);
+			memcpy(buff, &epb, epb_len);
+			i+=epb_len;
+			memcpy(buff+i, pd, caplen);
+			i+=caplen;
+			if (caplen % 4) {
+				int pad_len= 4 - caplen % 4;
+				memcpy(buff+i, &padding, pad_len);
+				i+=pad_len;
+			}
+			if ((comment != NULL) && (strlen(comment) > 0) && (strlen(comment) < G_MAXUINT16)) {
+                option.type = OPT_COMMENT;
+                option.value_length = (guint16)strlen(comment);
+				memcpy(buff+i, &option, sizeof(struct option));
+				i+= sizeof(struct option);
+				memcpy(buff+i, comment, (int) strlen(comment));
+				i+= (int) strlen(comment);
+				if (strlen(comment) % 4) {
+					int option_len = 4 - strlen(comment) % 4;
+					memcpy(buff+i, &padding, option_len);
+					i+=option_len;
+				}
+			}
+			if (flags != 0) {
+				option.type = EPB_FLAGS;
+				option.value_length = sizeof(guint32);
+				memcpy(buff+i, &option, sizeof(struct option));
+				i+=sizeof(struct option);
+				memcpy(buff+i, &flags, sizeof(guint32));
+				i+=sizeof(guint32);
+				option.type = OPT_ENDOFOPT;
+				option.value_length = 0;
+				memcpy(buff+i, &option, sizeof(struct option));
+				i+=sizeof(struct option);
+			}
+			memcpy(buff+i, &block_total_length, sizeof(guint32));
+			i+=sizeof(guint32);
+			return write_func(write_data_info, (const guint8*)&buff, i, bytes_written, err);
+		}
         if (!write_func(write_data_info, (const guint8*)&epb, sizeof(struct epb), bytes_written, err))
                 return FALSE;
         if (!write_func(write_data_info, pd, caplen, bytes_written, err))