tcpdump mailing list archives
Re: proposed new pcap format
From: Guy Harris <guy () alum mit edu>
Date: Tue, 6 Apr 2004 11:20:57 -0700
On Apr 5, 2004, at 10:39 PM, Ryan Mooney wrote:
What about adding the concept of arbitrary meta-packets that can sit anywhere in the capture stream. These could be used to encode comments, and other meta-data.
In Michael Richardson's proposal, a capture file is a sequence of records, each of which contains one or more type/length/value items. A record need not contain a PCAP_DATACAPTURE item; if it doesn't contain one, it'd be meta-data without a packet, and if it does contain one, it's a packet, possibly with additional meta-data.
In Loris Degioanni and Fulvio Risso's proposal, a capture file is a sequence of records, each of which is a type/length/value item. Some of the record types include a sequence of type/length/value options within them.
Both of those schemes support the concept of arbitrary meta-data that can appear anywhere in the capture stream, encoding comments and other meta data...
This concept could also be used for other internal meta-data for example capture information like direction, interface info, etc...). There would have to be a way to tag future as part of a meta-data stream (to handle multiple interfaces, etc..).
...and handle multiple interfaces, as well as meta-data associated with packets and not associated with packets...
This could be done in a way to preserve the ability to cat multiple files together
...and support the ability to concatenate multiple capture files with "cat".
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- Re: proposed new pcap format Hannes Gredler (Apr 02)
- <Possible follow-ups>
- Re: proposed new pcap format Christian Kreibich (Apr 02)
- Re: proposed new pcap format Darren Reed (Apr 02)
- Re: proposed new pcap format Michael Richardson (Apr 02)
- Re: proposed new pcap format Michael Richardson (Apr 12)
- Re: proposed new pcap format Darren Reed (Apr 02)
- Re: proposed new pcap format Guy Harris (Apr 02)
- Re: proposed new pcap format Richard Sharpe (Apr 04)
- Re: proposed new pcap format Ryan Mooney (Apr 05)
- Re: proposed new pcap format Guy Harris (Apr 06)
- Re: proposed new pcap format Ryan Mooney (Apr 05)
- Re: Proposed new pcap format Michael Richardson (Apr 05)
- Re: Proposed new pcap format Loris Degioanni (Apr 06)
- Re: Proposed new pcap format Richard Sharpe (Apr 07)
- Re: Proposed new pcap format Michael Richardson (Apr 12)
- Re: Proposed new pcap format Loris Degioanni (Apr 13)
- Re: Proposed new pcap format Loris Degioanni (Apr 06)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 09)
- Re: Proposed new pcap format Darren Reed (Apr 09)
- Re: Proposed new pcap format Guy Harris (Apr 10)
- Re: Proposed new pcap format Darren Reed (Apr 10)
- Re: Proposed new pcap format Michael Richardson (Apr 12)
- Re: Proposed new pcap format Darren Reed (Apr 09)