Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: [Ethereal-cvs] rev 16615: /trunk/image/: Makefile.nmake dumpcap.rc.in /trunk/

[Ulf Lamping <ulf.lamping@xxxxxx>]

Richard Sharpe wrote:

> Hmmm, while that might be an interesting exercise, why do we need a 
> separate capture tool?

Because we already do capturing in a two process model.

Side effects of the effort:

a: don't need to load a whole new instance of Ethereal (which is far 
more than we need to do) as this takes it's time. A small tool (the 
Win32 exe seems to become ~200kB instead of the xMB "monster" Ethereal 
is) can probably be loaded much faster (hmmm, with todays operating 
system caching I'm not too sure about this)
b: we can use privilege separation, as only the capture tool needs root 
privileges, Ethereal itself can run under any (lowest privilege) user 
account.
c: having a dedicated capture tool seems to be handy
d: better separation of code might make it even possible to have the 
same capture code for tethereal and ethereal

> In addition, it would be good, if this project proceeds, that we 
> refactor things so that the two tools can be produced (dumpcap and 
> ethereal) with minimal duplication of code. Zero would be a good number!

Hmmm, honorable task.

As I don't like code duplication, I agree with this. Taking this a bit 
"higher", even tethereal might not need to have it's own capture code 
and share the common code. In fact I don't see any real reason why 
ethereal and tethereal need to have different capture code ...

Regards, ULFL