tcpdump mailing list archives
Re: How to record plain text in a pcap file?
From: Darren Reed <Darren.Reed () Oracle COM>
Date: Wed, 06 Apr 2011 04:41:34 +1000
Guy Harris wrote:
On Apr 4, 2011, at 10:09 PM, Darren Reed wrote:Is there a DLT type for "plain text"?No.That is, can I record or insert text based comments or other data to a pcap file?No, but you can record them in a pcap-NG file.
My reading of your list of tradeoffs is that even for pcap-NG, LINKTYPE_TEXT is required as it has no other way to record text (no comment fields, for example, attached to packet blocks.)
The handling of the presence of LINKTYPE_TEXT will be the same for any other link type that is unknown to the tools that encounter it, so there's nothing new or special about that.
For that matter, it may be worthwhile improving the failure modes of tcpdump, if only in dealing with LINKTYPE_PPI.
So I'll ask, does anyone think that LINKTYPE_TEXT should not be added? Darren - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- How to record plain text in a pcap file? Darren Reed (Apr 04)
- Re: How to record plain text in a pcap file? Guy Harris (Apr 04)
- Re: How to record plain text in a pcap file? Darren Reed (Apr 05)
- Re: How to record plain text in a pcap file? Guy Harris (Apr 05)
- Re: How to record plain text in a pcap file? Darren Reed (Apr 05)
- Re: How to record plain text in a pcap file? Guy Harris (Apr 04)