On Fri, 9 Dec 2022 16:42:11 +1100 David Gibson <david(a)gibson.dropbear.id.au> wrote:pcap(), pcapm() and pcapmm() duplicate some code, for the actual writing to the capture file. The main purpose pf pcapm() and pcampp() not calling pcap seems to be to avoid repeatedly calling gettimeofday(). We can accomplish that while still sharing code by adding a new helper which takes the packet timestamp as a parameter.Another purpose is to avoid logging errors for single messages in batches -- if something goes wrong with the log file, it gets noisy to the point of making passt unusable during throughput tests. Sure, it's quite unlikely to happen during normal operation -- still, should you re-spin, pcap_frame() could return errors and callers could abort early in case. -- Stefano