Wireshark · Ethereal-dev: Re: [ethereal-dev] Checked in Wiretap changes to eliminate "ftell()" calls

[Guy Harris <gharris@xxxxxxxxxxxx>]

> Not sure if you really want to mmap(), given that you can deal with
> really large (potentially unbounded) files.

I forget whether I mentioned this in previous mail about this, but you
don't have to map the entire file - you can initially map, say, the
first 64MB, and when you try to refer to a file past the end of the
mapped region, map the appropriate 64MB (or smaller) region in (or
perhaps move the mapped region by 64MB-64K, or something, to handle the
case of a packet split across one of the 64MB boundaries).  I suspect
most access to the capture is sequential, so that shouldn't be *too*
bad.