Re: Proposed new pcap format

["Loris Degioanni" <loris () netgroup-serv polito it>]

Hi,

> > 3.3
> > the packet block has a description of which interface the packet was
> > captured on.
> > It should also have a mandatory flag that describes whether we picked
the
> > packet from Rx or Tx on the interface.
> > This should be a mandatory field in the header (1 bit) and not
> > optional.
>
> I'd prefer a general flag field, which would include a direction
> indication (which might also include, for received packets, an
> indication of how it was received, e.g.
> unicast/multicast/broadcast/promiscuous/not specified), and could also
> include some other information (length of FCS, with 0 meaning "absent",
> and possibly link-layer-type-dependent error flags such as "runt frame",
> "bad CRC", etc.).

The problem is: all this information is not granted to be present, so you
need to define default values, which in most cases mean "0", or "not
available", or "absent". At this point why not using options?


Loris
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.