Hi,
Would something like this be more efficient?
Index: pcapio.c
===================================================================
--- pcapio.c (revision 47793)
+++ pcapio.c (working copy)
@@ -602,6 +602,8 @@
guint64 timestamp;
gboolean have_options = FALSE;
const guint32 padding = 0;
+ guint8 buff[4096];
+ int i = 0;
block_total_length = (guint32)(sizeof(struct epb) +
ADD_PADDING(caplen) +
@@ -628,6 +630,46 @@
epb.timestamp_low = (guint32)(timestamp & 0xffffffff);
epb.captured_len = caplen;
epb.packet_len = len;
+ if(block_total_length<4096){
+ int epb_len= sizeof(struct epb);
+ memcpy(buff, &epb, epb_len);
+ i+=epb_len;
+ memcpy(buff+i, pd, caplen);
+ i+=caplen;
+ if (caplen % 4) {
+ int pad_len= 4 - caplen % 4;
+ memcpy(buff+i, &padding, pad_len);
+ i+=pad_len;
+ }
+ if ((comment != NULL) && (strlen(comment) > 0) && (strlen(comment) < G_MAXUINT16)) {
+ option.type = OPT_COMMENT;
+ option.value_length = (guint16)strlen(comment);
+ memcpy(buff+i, &option, sizeof(struct option));
+ i+= sizeof(struct option);
+ memcpy(buff+i, comment, (int) strlen(comment));
+ i+= (int) strlen(comment);
+ if (strlen(comment) % 4) {
+ int option_len = 4 - strlen(comment) % 4;
+ memcpy(buff+i, &padding, option_len);
+ i+=option_len;
+ }
+ }
+ if (flags != 0) {
+ option.type = EPB_FLAGS;
+ option.value_length = sizeof(guint32);
+ memcpy(buff+i, &option, sizeof(struct option));
+ i+=sizeof(struct option);
+ memcpy(buff+i, &flags, sizeof(guint32));
+ i+=sizeof(guint32);
+ option.type = OPT_ENDOFOPT;
+ option.value_length = 0;
+ memcpy(buff+i, &option, sizeof(struct option));
+ i+=sizeof(struct option);
+ }
+ memcpy(buff+i, &block_total_length, sizeof(guint32));
+ i+=sizeof(guint32);
+ return write_func(write_data_info, (const guint8*)&buff, i, bytes_written, err);
+ }
if (!write_func(write_data_info, (const guint8*)&epb, sizeof(struct epb), bytes_written, err))
return FALSE;
if (!write_func(write_data_info, pd, caplen, bytes_written, err))
