Pcap Files
 

Hello,

I am a comlete newbie in linux so forgive me is ask dum questions (also tell me if i am posting in the wrong place).

I need to write a program that sniffs packets coming thru and pick some of them out but i dont want to do it directly from the interface. I understand that there is some mechanism in linux that writes all packets to a temporary file (new one every 10 minutes?) but i cant find anything about it on the web. can some one explain it or direct me to where i can read about it.

Things i know i need to know are:

In what directory is is saved
what is the exact format of the file
which is better: analyze it by myself or with pcap lib.

And probably many more things i dont even know i need to know...

please advise...

Ori.