Wiretap library

John McHugh <[email protected]>
Newsgroups gmane.network.ethereal.user
Message-ID <[email protected]>
I have a need to work with a large amount of compressed (.gz) packet  
header data obtained from ethernet sources with tcpdump.  In  
compressed form, there are on the order of 10,000 files totaling  
about 160GB.

I would like to be able to open the files, and read the records  
without decompressing each file first.  The current version of the  
program uses libpcap and I decompress the input into a pipe.  I can  
only process one file per run and a large portion of my time is taken  
up with saving and restoring state between runs.

Has anyone had experience using wiretab as a library to support this  
kind of activity?  Is there any documentation that would help  
identify the appropriate interface routines?  A search of the  
ethereal site shows discussion of this in the early days of the  
project, but nothing recently.

John McHugh
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.