[Winpcap-users] Change to pcap_dump_open
gvanem at broadpark.no
Tue Feb 12 14:38:30 PST 2013
"Clemens Gruber" <clemens.gruber at pqgruber.com> wrote:
> could you please make the following change to the implementation of
> pcap_dump_open, because at the moment it is opened with fopen, thus not
> enabling other users to access the file at the same time. My suggestion
> is to change Line 1719 as follows.
> From: "f = fopen(fname, "wb");"
> To: "f = _fsopen(fname, "wb", _SH_DENYWR);"
> See http://msdn.microsoft.com/en-us/library/aa246901(v=vs.60).aspx
I would recomend using '_sopen()' instead. It's more versatile and is
meant for "open a file for sharing".
And specifying an '_O_SEQUENTIAL' in the flags should make the read/write
access faster in most cases. A pcap-dump file is usually accessed in non-
random order. Not sure how much speed gain this gives.
And I'm not sure if '_locking()'-ing the file-handle is needed. I.e. what happens
when your process writes to the dump and some other process reads at the
same location? Well, here is a example from something I've wrote years ago:
FILE *fopen_excl (const char *file, const char *mode)
int fd, flags = _O_CREAT | _O_TRUNC | _O_WRONLY | _O_BINARY;
flags |= _O_SEQUENTIAL;
fd = _sopen (file, flags, SH_DENYWR, S_IREAD | S_IWRITE);
if (fd <= -1)
return fdopen (fd, mode);
> (If pcap_dump_fopen had worked, I would have opened the handle myself
> with fsopen before giving it to WinPcap, but pcap_dump_fopen is not
> exported by the library.)
More information about the Winpcap-users