Non dropping packet monitor

[Phil Regnauld]

Charles Swiger (cswiger) writes:
> >
> >Any suggestions?  Is there some pcap option that I need to look at?
> 
> If your dumps will fit into a RAM disk, use that, otherwise you're  
> presumably [1] going to be limited to how fast you can scribble the  
> packets to your disks.  Figure out the fastest you can do that, and  
> then use dummynet to limit your network bandwidth to what your system  
> is capable of capturing...

	I seem to remember that IPFlter has a facility for logging
	packets where it's possible to deny forwarding of packets
	if the process reading the logging socket has disappeared
	or isn't reading fast enough.  Am I wrong ?

	Phil