Non dropping packet monitor

[Chuck Swiger]

Phil Regnauld wrote:
> Charles Swiger (cswiger) writes:
>>> Any suggestions?  Is there some pcap option that I need to look at?
>> If your dumps will fit into a RAM disk, use that, otherwise you're  
>> presumably [1] going to be limited to how fast you can scribble the  
>> packets to your disks.  Figure out the fastest you can do that, and  
>> then use dummynet to limit your network bandwidth to what your system  
>> is capable of capturing...
> 
> 	I seem to remember that IPFlter has a facility for logging
> 	packets where it's possible to deny forwarding of packets
> 	if the process reading the logging socket has disappeared
> 	or isn't reading fast enough.  Am I wrong ?

I'm not sure.  :-)  If what you've suggested _is_ available, it would be a
better solution to the original problem....

-- 
-Chuck