Re: Proposed new pcap format

["Ronnie Sahlberg" <ronnie_sahlberg () ozemail com au>]

----- Original Message ----- 
From: "Loris Degioanni"
Sent: Monday, April 12, 2004 2:55 PM
Subject: Re: [tcpdump-workers] Proposed new pcap format



> Essentially, what you propose is that the SHB CONTAINS a section rather
than
> MARKING its beginning. The SHB, in fact, as any other block, includes a
> Block Total Length field, which could be used to specify the length of
data
> that follows the header.
> However, this field is 32 bit only. Do you think
> it's too short, considering that we could put another SHB after 4 GB?

32 bits is too short.  (some) People are already today using >2GB capture
files with all
the pains that brings with pcap and pcap-supposed-to-be-compliant
implementations
that treat file-length/offset as signed integer.


> If the SHB is not a market but a container, as I said before, the other
> blocks will be nested inside it. Moreover, Compression Blocks or
Encryption
> Blocks could add a further level of nesting. In a general way, my opinion
is
> that allowing nesting provides more versatility.

I think allowing nesting adds unneeded complexity.



-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.