tcpdump mailing list archives
Re: libpcap pcap_sendpacket support across platforms.
From: Guy Harris <guy () alum mit edu>
Date: Tue, 23 Mar 2004 14:44:07 -0800
On Mar 23, 2004, at 1:06 PM, Jefferson Ogata wrote:
Michael Richardson wrote:okay. Can we call the next release libpcap 1.0 then? Anyone want to make any non-backwards compatible changes to the file format?A metadata packet-type would be useful. Then you could tag a file with the pcap expression it was captured with, along with other metadata. If it's just a packet type you can drop in new metadata wherever you like.
Yes. My inclination would be to have the per-packet header contain:a 32-bit interface index, for the interface on which the packet arrived;
a time stamp; the captured data length; the actual packet length.I suspect few, if any, machines will have more than 2^31 interfaces, so if the interface index has the uppermost bit set, it'd be a record type - the time stamp and actual packet length might or might not be meaningful, and the captured data length would be the length of the data in the record (so that code that doesn't know about that type of record can just skip it).
If the file magic number has the uppermost bit set, the file header would look like a record - and if we decree that it *is* a record (with the requirement that the first record of a file must be such a record), that could enable concatenation of captures by just concatenating files (which Michael Richardson has mentioned as a desirable goal).
There would also be records for interface properties, so that a capture would start with the "file magic number" record and then have, before the first packet on an interface, a record giving interface properties such as link layer header type, name, interface index, etc..
Other records could contain the filter expression, comments, packet drop statistics, etc..
- This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe
Current thread:
- libpcap pcap_sendpacket support across plaatforms. Mark Pizzolato (Mar 12)
- Re: libpcap pcap_sendpacket support across plaatforms. Guy Harris (Mar 12)
- Re: libpcap pcap_sendpacket support across platforms. Mark Pizzolato (Mar 13)
- Re: libpcap pcap_sendpacket support across platforms. Guy Harris (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Michael Richardson (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Jefferson Ogata (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Guy Harris (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Guy Harris (Mar 23)
- Message not available
- Re: libpcap pcap_sendpacket support across platforms. Guy Harris (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Michael Richardson (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Mark Pizzolato (Mar 13)
- Re: libpcap pcap_sendpacket support across plaatforms. Guy Harris (Mar 12)
- Re: libpcap pcap_sendpacket support across platforms. Richard Sharpe (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Michael Richardson (Mar 23)
- Message not available
- Message not available
- Message not available
- Re: libpcap pcap_sendpacket support across platforms. Ste Jones (Mar 26)
- Re: libpcap pcap_sendpacket support across platforms. Stephen Donnelly (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Guy Harris (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Stephen Donnelly (Mar 23)
- Re: libpcap pcap_sendpacket support across platforms. Guy Harris (Mar 23)