Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-693: use pcap_dump_open_append where supported

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-11-02 12:59:54 -07:00
parent c25d5cecb2
commit ceaec09024
4 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/iosource/pcap/Dumper.cc
View file

@ -68,11 +68,15 @@ void PcapDumper::Open()
else
{
#ifdef HAVE_PCAP_DUMP_OPEN_APPEND
dumper = pcap_dump_open_append(pd, props.path.c_str());
#else
// Old file and we need to append, which, unfortunately,
// is not supported by libpcap. So, we have to hack a
// little bit, knowing that pcap_dumpter_t is, in fact,
// little bit, knowing that pcap_dumper_t is, in fact,
// a FILE ... :-(
dumper = (pcap_dumper_t*)fopen(props.path.c_str(), "a");
#endif
if ( ! dumper )
{
Error(util::fmt("can't open dump %s: %s", props.path.c_str(), strerror(errno)));