Wireshark · Wireshark-dev: Re: [Wireshark-dev] dumpcap performance?

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Anders Broman wrote:
> Hi,
> Would something like this be more efficient?

Basically you're proposing building one bigger buffer for writing rather 
than doing several smaller writes?

My experience would say no: memcpy()s should be avoided whenever 
possible.  Admittedly my experience does not include a lot of file I/O 
but I would think/hope the OS would do a good job of buffering smaller 
writes into larger I/Os.

Another way to solve the many-small-writes problem (if it is a problem) 
would be to use writev().