Re: proposed new pcap format

[Ryan Mooney <ryan () pcslink com>]

There are probably good reasons why what I'm suggesting here is,
as stated, a bad idea; but since the packet storage format is up
for discussion I thought I'd throw this out to see if it peaks
anyones interest.

What about adding the concept of arbitrary meta-packets that can
sit anywhere in the capture stream.  These could be used to encode
comments, and other meta-data.  

This concept could also be used for other internal meta-data for 
example capture information like direction, interface info, etc...).
There would have to be a way to tag future as part of a meta-data
stream (to handle multiple interfaces, etc..).  

This could be done in a way to preserve the ability to cat multiple 
files together based on some sort of timestamp/crypto hash as the
tag ID, but that requires a bit more thought :>

Just a random thought..

On Sun, Apr 04, 2004 at 01:42:48AM -0800, Richard Sharpe wrote:
> On Fri, 2 Apr 2004, Guy Harris wrote:
>
> > On Mar 25, 2004, at 9:31 AM, Richard Sharpe wrote:
> >
> > > One of the items I would like support for in a new format is comments.
> > > That is, the ability to add textual comments to frames. These comments
> > > would be ignored by tools that do not understand them, but they would 
> > > be
> > > displayed by tools capable of understanding them.
> >
> > Would all comments necessarily be associated with frames?
> >
> > One counter-example would be a comment associated with the capture as a 
> > whole (I think the old DOS Sniffer format supported that).
>
> Hmmm, that is a good point ...
>
> Regards
> -----
> Richard Sharpe, rsharpe[at]richardsharpe.com, rsharpe[at]samba.org, 
> sharpe[at]ethereal.com, http://www.richardsharpe.com
>
> -
> This is the tcpdump-workers list.
> Visit https://lists.sandelman.ca/ to unsubscribe.

-- 
> -=-=-=-=-=-=-<>-=-=-=-=-=-<>-=-=-=-=-=-<>-=-=-=-=-=-<>-=-=-=-=-=-=-<
Ryan Mooney                                      ryan () pcslink com 
<-=-=-=-=-=-=-><-=-=-=-=-=-><-=-=-=-=-=-><-=-=-=-=-=-><-=-=-=-=-=-=-> 
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.