Re: libpcap patches for DLT_SITA support

[Guy Harris <guy () alum mit edu>]

Fulko Hew wrote:

> On one hand, my version queries and interoperates with remote
> devices to allow remote capture.  What it does do (unfortunately
> right now) is ignore any 'local' linux monitorable devices.  It would
> be nice to be able to monitor/select either remote (SITA) or local
> (Linux) devices.

Make that "or local devices", without the "(Linux)" part.  There's no 
need to restrict this to Linux; it's just code that connects to a remote 
TCP server and exchanges messages with it.

What we probably really need is a syntax to specify remote as well as 
local devices.  WinPcap supports a pcap_open() routine that takes a URL 
as an argument:

        http://www.winpcap.org/docs/docs_41b2/html/group__remote__source__string.html

We could have an (unofficial) "sita:" URL scheme to specify SITA 
devices, just as we could have other schemes to specify protocols other 
than rpcap (e.g., perhaps "ssh:" to specify that tcpdump should be run 
remotely to do the capture).

With that approach - and probably with other approaches - having a 
separate file for the SITA code would still be appropriate.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.