tcpdump mailing list archives
Re: Proposed new pcap format
From: "Ronnie Sahlberg" <ronnie_sahlberg () ozemail com au>
Date: Mon, 12 Apr 2004 16:14:18 +1000
----- Original Message ----- From: "Loris Degioanni" Sent: Monday, April 12, 2004 2:55 PM Subject: Re: [tcpdump-workers] Proposed new pcap format
Essentially, what you propose is that the SHB CONTAINS a section rather
than
MARKING its beginning. The SHB, in fact, as any other block, includes a Block Total Length field, which could be used to specify the length of
data
that follows the header. However, this field is 32 bit only. Do you think it's too short, considering that we could put another SHB after 4 GB?
32 bits is too short. (some) People are already today using >2GB capture files with all the pains that brings with pcap and pcap-supposed-to-be-compliant implementations that treat file-length/offset as signed integer.
If the SHB is not a market but a container, as I said before, the other blocks will be nested inside it. Moreover, Compression Blocks or
Encryption
Blocks could add a further level of nesting. In a general way, my opinion
is
that allowing nesting provides more versatility.
I think allowing nesting adds unneeded complexity. - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- Re: Proposed new pcap format, (continued)
- Re: Proposed new pcap format Guy Harris (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Michael Richardson (Apr 16)
- Re: Proposed new pcap format Loris Degioanni (Apr 11)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 11)
- Re: Proposed new pcap format Loris Degioanni (Apr 13)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Hannes Gredler (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 14)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 11)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 11)
- Re: Proposed new pcap format Loris Degioanni (Apr 13)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Michael Richardson (Apr 16)
- Re: Proposed new pcap format Guy Harris (Apr 21)
- Re: Proposed new pcap format Darren Reed (Apr 22)
- Re: Proposed new pcap format Jefferson Ogata (Apr 22)
- Re: Proposed new pcap format Darren Reed (Apr 22)