Guy Harris

The type should be 296, not 297, as that's the next available type.

> @guyharris 296 was applied for by FIRA_UCI People can give a number in a pull request, but that doesn't mean they'll get that number. In the case of that...

There should probably be a command-line option as well, so you don't _have_ to change the file; the file would be for more persistent port mappings.

He did use a larger buffer - 16KiB. That was probably on Linux; the default `st_blksize` on Linux appears to be the page size, so it was probably 4KiB. If...

As for an automatically-allocated buffer: - [The Linux `setvbuf()` documentation](http://man7.org/linux/man-pages/man3/setvbuf.3.html), which presumably is describing the glibc version, "If the argument *`buf`* is `NULL`, only the mode is affected; a new...

Yeah, the Linux man page isn't as explicit as I'd like, but "If the argument `*buf*` is `NULL`, only the mode is affected" does suggest that the size isn't affected....

> We are going to need it for pcapng. Yes. I wouldn't want to require pcapng to get the bigger stdio buffer, and I'm not sure whether we should have...

> `pcap_dumper_t` is already an opaque structure (already since its initial introduction in 1999), the fact that it is type-casted from `FILE *` is an internal implementation detail. Are there...

> Do you need me to do anything else with this to merge it in? We need you to, at minimum, answer the questions I recently asked in the-tcpdump-group/tcpdump-htdocs#27 and...

This all applies to other filter operations that adjust the payload offset, such as "pppoe" and "mpls". Fixing it would require some restructuring of the filter expression compiler, so that...