Wireshark · Ethereal-dev: Re: [ethereal-dev] wiretap and print suggestions

[Guy Harris <gharris@xxxxxxxxxxxx>]

> If the filename ends with ".gz" and zlib support is available, wiretap
> should save the file compressed.

...if it's a format that can be saved without doing any seeks.  (Some
formats would require that, unless we significantly changed the way we
save packets - for example, the Network Monitor format requires that the
header of the file contain:

	a time stamp for the start of the capture - the time stamps of
	the packets are given as a 32-bit count of milliseconds since
	that time;

	in effect, the offset right past the last packet of the file, as
	that's the offset of a table of starting offsets for all the
	frames.

There are ways in which that could perhaps be done without seeks - but
given that Network Monitor can't read gzipped files, it's not clear it'd
be worth saving files in NetMon format gzipped; you could get a
gunzipper for Windows, but....)