Re: Request for a new DLT

[Guy Harris <guy () alum mit edu>]

Fulko Hew wrote:

> Well, I looked at it, and it sounds like a good idea, but it is 
> relatively heavy
> weight (I only need to transport 4 bytes, and PPI has 8 bytes of overhead
> (200% in my case)  So I'm going to graciously decline and still ask for
> my own DLT called 'DLT_SITA'.
>
> (This also leave my options open for the future in monitoring other things
> like STREAMs, named pipes, shared memory communications devices, etc.)

So your 4-byte (or 5-byte, as per your original mail) header will be 
sufficient for that?  (Once you've picked a header format, you can't 
change it - you'd need a different DLT_ value for a different header, as 
the DLT_ value should be sufficient to allow a file to be interpreted.)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.