Do you know how to read a pcap file continuously?

Wed Sep 18 13:21:18 EDT 2013

On Wed, Sep 18, 2013 at 10:14 AM, Carter Bullard <carter at qosient.com> wrote:

> Rather than thinking about implementaion, I think it is more important to
> decribe the features.  So should we exit if the file goes away ???

My opinion: no, it should not exit if the filename disappears,
but that it should warn if it detects the inode has changed or if the
file got truncated; that it should reopen the file in those situations.
I believe that's how tail operates and I think that make sense.

But hey, I'm not the guy who was originally asking for the feature,
so my opinion isn't that important. :D

Jim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130918/264ee4da/attachment.html>