> On another note, any reason ethereal doesn't support writing gzip'd > files? Because Wiretap doesn't. :-) As for why Wiretap doesn't, with some capture file formats I think it'd be impossible, as the capture files can't be written sequentially; however, Wiretap could, if asked to write out a compressed capture file in a format that can't be written sequentially, return a new WTAP_ERR code that tells its caller that it can't write out a compressed file. > There also appear to be a lot of opens and closes. Could you enumerate them? Some of them might be necessary, but some of them might just be bogus and unnecessary. (We currently open the file, read it sequentially, and then re-open it so that we can read it randomly, reading in the data for arbitrary packets. When capturing in "Update list of packets in real time" mode, as far as I know we need to have the file open twice, so that the sequential pass through the file won't get its file pointer moved out from under it if the user clicks on some random packet to display it, unless there's some way to avoid that.)
Powered by MHonArc 2.6.10