Re: Proposed new pcap format

["Fulvio Risso" <fulvio.risso () polito it>]

> -----Original Message-----
> From: tcpdump-workers-owner () lists sandelman ca
> [mailto:tcpdump-workers-owner () lists sandelman ca]On Behalf Of Hannes
> Gredler
> Sent: mercoledi 14 aprile 2004 21.05
> To: tcpdump-workers () lists sandelman ca
> Cc: tcpdump-workers () tcpdump org; Loris Degioanni
> Subject: Re: [tcpdump-workers] Proposed new pcap format
>
>
> On Wed, Apr 14, 2004 at 08:25:25AM +0200, Fulvio Risso wrote:
>
> | I agree with Loris.
> | I know that this flag would be extremely useful, but there are
> no guarantees
> | that you're able to get this info from the NIC / NIC driver.
> | Perhaps, what we should to is to use 2 bits for each flag,
> where the first
> | one means "flag is valid", and the second one it is the flag value.
> | E.g.:
> |
> |   1                 0                0                  0 . . . . . .
> |  ^^^               ^^^              ^^^                ^^^
> |  "incoming" flag   packet is        "outcoming" flag   No meaning
> |  is valid          not "incoming"   is NOT valid
>
>
>
> why not assigining simple codepoints for the direction information;
>
> i.e.
>
> 0 ... invalid/undefined/unsupported etc.
> 1 ... incoming
> 2 ... outgoing

Just because "2" requires two bits in binary ;-))
What you say is more or less what I wrote; unfortunately I forgot to say
that the flags string (in the example) is written in binary and every flag
requires two bits ;-))

        fulvio

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.