Oh and with memory traces, have an option to dump it to a file if the
user wants to. :)
On Wed, 16 Sep 1998, Don Lafontaine wrote:
>
> A discussion was going on a while back on pcap and filters.
>
> My thought is: Why not do POST filtering of our own. Trap all packets,
> but filter the display. That way, we could theoretically reshow the same
> data under different filters without having to restart a trace. The NG
> Sniffer does this I believe. (I'm pretty sure).
>
> Another thing, it would be nice to have an option to capture to memory
> instead of disk. There is a discrepancy between the NG sniffer and
> Ethereal data that bothers me somewhat. Make a command-line/menu option
> to reserve xMB memory, and use that for the trace. (Circular
> bufferring for those long traces waiting for an event to occur).
>
> Just throwing my $.02 into the mix.
>
> Don.
>
