tcpdump mailing list archives
Re: Proposed new pcap format
From: "Ronnie Sahlberg" <ronnie_sahlberg () ozemail com au>
Date: Mon, 12 Apr 2004 16:10:44 +1000
----- Original Message ----- From: "Loris Degioanni" Sent: Monday, April 12, 2004 2:56 PM Subject: Re: [tcpdump-workers] Proposed new pcap format
I'd prefer a general flag field, which would include a direction indication (which might also include, for received packets, an indication of how it was received, e.g. unicast/multicast/broadcast/promiscuous/not specified), and could also include some other information (length of FCS, with 0 meaning "absent", and possibly link-layer-type-dependent error flags such as "runt frame", "bad CRC", etc.).The problem is: all this information is not granted to be present, so you need to define default values, which in most cases mean "0", or "not available", or "absent". At this point why not using options?
If they are made mandatory they WILL always be present, or else it will not be a pcap compatible file. - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- RE : Libpcap question, (continued)
- RE : Libpcap question Jacky Buyck (Apr 18)
- Re: Proposed new pcap format Guy Harris (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 14)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 14)
- Re: Proposed new pcap format Jefferson Ogata (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 14)
- Re: Proposed new pcap format Guy Harris (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Michael Richardson (Apr 16)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 11)
- Re: Proposed new pcap format Loris Degioanni (Apr 13)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Hannes Gredler (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 14)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 11)
- Re: Proposed new pcap format Loris Degioanni (Apr 13)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Michael Richardson (Apr 16)