3 ms·
>It feels magical to have a 3-page C program sitting over libpcap giving reports in miliseconds that would take wireshark minutes. Any demos available of somet
by colechristensen 1y ago
>It feels magical to have a 3-page C program sitting over libpcap giving reports in miliseconds that would take wireshark minutes.
Any demos available of something like this?
- elevation 1y agoSadly proprietary, but the core of it was to open a file with pcap_open_offline() [0], and then calling pcap_next() from a loop and reading a few bits out of the packet buffer. With NVMe disks, the information I needed was instantaneous for a 10M packet file. https://manpages.debian.org/stretch/libpcap0.8-dev/pcap_open_offline_with_tstamp_precision.3pcap.en.html https://manpages.debian.org/stretch/libpcap0.8-dev/pcap_open...