Do we really need 4 bytes to store the endpoint address in the header?
Without changing the size of the header,
what about splitting the four bytes of endpoint address into two 16 bit integers
one of them is endpoint address and the other is which usb interface
the capture was taken on ? the usb interface number could just be an
index starting at 0 for the first usb port and incrementing by one for
each other port.
So that in case we have a capture taken from multiple interfaces at
the same time we would distinguish the frames between the different
interfaces.
On 10/23/06, Joerg Mayer <[EMAIL PROTECTED]> wrote:
On Sun, Oct 15, 2006 at 07:35:36PM +0200, Paolo Abeni wrote:
> p.s. the gettimeofday syscall give some overhead to the sniffing code,
> but currently the text interface provided by the kernel is IMHO the real
> bottleneck.
Could you post a kernel-patch that fixes the worst problems with the
interfaces without breaking libpcap? I'm thinking of the timestamp
problem and the incomplete captures - so in case I want a complete
capture or better timestamps I could just apply your patch and rebuild
the kernel?
thanks
Joerg
PS: OK, the timestamps have already been worked around and might not be
doable withouth breaking the ABI but the capture thing should.
--
Joerg Mayer <[EMAIL PROTECTED]>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
