> > Or build the packet list and reuse the current code?
>
> No. That'd require it to make two passes over the capture file (one
> pass to build the packet list, and one pass to process the packets in
> that list), and require extra memory to store the packet
> list; it'd also
> mean that if we ever made Wiretap work, in
> sequential-access-only mode,
> on pipes, you couldn't get the statistics when reading a pipe.
I agree, but unfortunately I can't commit to doing it soon right now.
This whole change was triggered by my need to easily post-process
the protocol stats, and what I have here locally satisfies me for now
- although it's crude. I'm going to stick with what I have here for the
next couple of days (because I need to actually collect some stats
and process them *now* from some captures here)! If I have time
later, I'll return with a clean implementation. Meanwhile I'll
submit the crude patch for archival purposes in case
somebody else is in an urgent position like me.
If anybody else (Joerg?) wants to change the stats generation
meanwhile I'll appreciate a note to avoid duplication of effort.
Patch will now be submitted in a separate email for archival with
proper [PATCH] ... subject...
Vassilii
