0

Using libpcap has proven really easy, but, speed is always an issue with giant (in an arbitrary sense) .pcap dumps.

Are there any common practices for just sampling a dump? Perhaps something that effectively says "Read every fifth frame" as the pcap filter, Or should I simply just do nothing some times in the pcap_handler?

Aage Torleif
  • 1,907
  • 1
  • 20
  • 37

1 Answers1

1

If you want to dump only a fraction of the packets, the way you'd do that is, indeed, to have the callback ignore some packets and write out others. Pcap filters are stateless and thus can't support "only match every fifth frame" or anything such as that.