[tcpdump-workers] TCPDump is truncating output file if italready exists..

[Steve Bonds]

On Sun, 13 Apr 2003, Guy Harris gharris-at-sonic.net |TCPdump Workers| wrote:

> It is probably not impossible to add a "pcap_dump_open_append()"
> function to libpcap that would do that, and, given that function, one
> could probably add a new command-line flag to get tcpdump to append to
> a capture file rather than truncating and overwriting it.

That would be very handy, but I'm not going to hold my breath waiting for
it.  In the meantime, try the "tcpslice" utility included with tcpdump to
split and merge raw packet capture files.

  -- Steve Bonds