[Winpcap-users] Change to pcap_dump_open

[Gisle Vanem]

"Clemens Gruber" <clemens.gruber at pqgruber.com> wrote:

> could you please make the following change to the implementation of
> pcap_dump_open, because at the moment it is opened with fopen, thus not
> enabling other users to access the file at the same time. My suggestion
> is to change Line 1719 as follows.
> From: "f = fopen(fname, "wb");"
> To: "f = _fsopen(fname, "wb", _SH_DENYWR);"
> 
> See http://msdn.microsoft.com/en-us/library/aa246901(v=vs.60).aspx

I would recomend using '_sopen()' instead. It's more versatile and is
meant for "open a file for sharing".
Ref. http://msdn.microsoft.com/en-us/library/aa273350(v=vs.60).aspx

And specifying an '_O_SEQUENTIAL' in the flags should make the read/write 
access faster in most cases. A pcap-dump file is usually accessed in non-
random order. Not sure how much speed gain this gives. 

And I'm not sure if '_locking()'-ing the file-handle is needed. I.e. what happens 
when your process writes to the dump and some other process reads at the 
same location? Well, here is a example from something I've wrote years ago:

FILE *fopen_excl (const char *file, const char *mode)
{
  int fd, flags = _O_CREAT | _O_TRUNC | _O_WRONLY | _O_BINARY;

#ifdef _O_SEQUENTIAL
  flags |= _O_SEQUENTIAL;
#endif

  fd = _sopen (file, flags, SH_DENYWR, S_IREAD | S_IWRITE);
  if (fd <= -1)
     return (NULL);
  return fdopen (fd, mode);
}

> (If pcap_dump_fopen had worked, I would have opened the handle myself
> with fsopen before giving it to WinPcap, but pcap_dump_fopen is not
> exported by the library.)

Static linking?

--gv