>It is useful to be able to write to the pcap's file descriptor.  This
>is used by some Ethernet simulators (like the experimenal Ethernet
>simulator for the SIMH VAX simulator) which run on many operating systems
>(and thus use the pcap interface to hide most of the OS-specific stuff).

i don't suppose there's some sort of way to indicate to libpcap[*]
that you want a writable descriptor, so that it only opens a writable
descriptor if you need it?

i have "users" in a "bpf" group that can read from the bpf devices,
but not write to them.  now that's broken, and i feel reluctant to
make the bpf devices writable by the group.

[*] it might also be nice to be able to tell libpcap that you want
unbuffered output to the capture file so that you can watch a captured
trace in "real time".  with stdio buffering it, the "playback" sucks
rocks.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
werdna@squooshy.com       * "information is power -- share the wealth."