From 33531b6de1d6c70d926d92b842db822f944f291a Mon Sep 17 00:00:00 2001 From: folkert Date: Thu, 16 Nov 2023 12:17:33 +0100 Subject: [PATCH] The pcap_dump_flush in phys::start_pcap is required to make sure no double pcap-headers are written to the .pcap-file. --- phys.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/phys.cpp b/phys.cpp index 8deca6e..e6567ff 100644 --- a/phys.cpp +++ b/phys.cpp @@ -97,14 +97,18 @@ void phys::start_pcap(const std::string & pcap_file, const bool in, const bool o pdh = pcap_dump_open(ph, temp.c_str()); if (!pdh) error_exit(false, "pcap_dump_open(%s) failed: %s", temp.c_str(), pcap_geterr(ph)); + + pcap_dump_flush(pdh); } } void phys::stop_pcap() { std::unique_lock lck(pcap_lock); - if (pdh) + if (pdh) { + pcap_dump_flush(pdh); pcap_dump_close(pdh); + } } void phys::pcap_write_packet_incoming(const timespec & ts, const uint8_t *const data, const size_t n)