search

rust-pcap / pcap

Rust language pcap library
Apache License 2.0
620 stars 144 forks source link

Support for flushing pcap captures to disk #162

Closed dglynos closed 3 years ago

dglynos commented 3 years ago

It's useful to be able to flush a pcap capture to disk. The patch provides support for this through Savefile.

dglynos commented 3 years ago

closing this as it's based on a master rather than a branch; will resubmit through a branch as it's cleaner

Trolldemorted commented 3 years ago

Shouldn't this be done automatically in the Drop implementation?

Trolldemorted commented 3 years ago

https://github.com/ENOFLAG/pcap/commit/ee44b9626dc4b392ab5e4750c8b49d539416a851 this is the commit we used

dglynos commented 3 years ago

Shouldn't this be done automatically in the Drop implementation?

Drop is great if you've got a capture that finished due to a user's action. However, if the capture was terminated for any other reason (an unexpected reboot, termination of a service etc.) and close() was not called on the file descriptor, then you're left with a file that may or may not contain any of the data captured. For this scenario, it's better to give users the chance to also flush when the application desires, not just at the end of a capture.