Closed alexmarder closed 3 years ago
I though about it and think that this might not work since pcapfix is designed to handle very large files that 1) are hard to pipe and 2) might not fit into memory (pcapfix seeks in files to look for proper packets, which is not possible on pipes)
So I assume best solution would be to use a small bash script that decompresses, fixes and compresses again.
Thanks for the reply. My thought with pipes is that you could buffer the input (depending on how far back you might seek). If you know the maximum possible backward seek in bytes, you could buffer the pipe with at least that many bytes.
Yes, you are right. I had an early version of pcapfix that worked this way. The problem was, that it took ages to repair a 150GB file. I dont really know how to fulfill both needs in a good way and - in best case - without completly rework the design of the tool :P
It would be great to have the ability to fix compressed pcaps (such as with gzip or bzip2), or have some way to pipe uncompressed output to pcapfix.