Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: [Ethereal-cvs] rev 16615: /trunk/image/: Makefile.nmake dumpcap.rc.in /trunk/

[Joerg Mayer <jmayer@xxxxxxxxx>]

On Mon, Nov 28, 2005 at 10:45:12PM +0100, Ulf Lamping wrote:
> a: don't need to load a whole new instance of Ethereal (which is far 
> more than we need to do) as this takes it's time. A small tool (the 
> Win32 exe seems to become ~200kB instead of the xMB "monster" Ethereal 
> is) can probably be loaded much faster (hmmm, with todays operating 
> system caching I'm not too sure about this)

Not valid on unix/linux

> b: we can use privilege separation, as only the capture tool needs root 
> privileges, Ethereal itself can run under any (lowest privilege) user 
> account.

full ack

> c: having a dedicated capture tool seems to be handy

ack

> d: better separation of code might make it even possible to have the 
> same capture code for tethereal and ethereal

full ack

> As I don't like code duplication, I agree with this. Taking this a bit 
> "higher", even tethereal might not need to have it's own capture code 
> and share the common code. In fact I don't see any real reason why 
> ethereal and tethereal need to have different capture code ...

Just a heretic thought: Why not use tcpdump to do the capturing for us?
In case we want the manpage for the capture syntax installed, we need
tcpdump anyway.

  Ciao
       Joerg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.