Re: Printing PPI packets

[Darren Reed <darren.reed () oracle com>]

On  5/05/11 01:42 PM, Guy Harris wrote:
> On May 5, 2011, at 1:38 PM, Darren Reed wrote:
>
>    
> > In terms of pcap, I'm becoming more and more of the opinion that DLT_PPI should not be used for anything other than 
> > DLT_IEEE802_11.
> >      
> Sounds good to me.
>
>    
> > Why am I not very interested in pcap-ng?
> > "The pcapng file format specification is still work in progress, see:"
> >
> > ... moving target.
> >      
> pcap-ng is extensible, so it's *always* going to be a moving target.  However, both Wireshark and libpcap read it, so there 
> are limits on how much it can move; the spec needs to be clarified to indicate what part isn't going to change and what part 
> is.

Looking through it, the first observation I'd make is that there should 
not have been any 16 bit fields. The one that concerns me most is the 
IDB which has a 16bit link type.

On Solaris, we're using numbers above 0x80000000 to represent a 
"private" number space for DLPI link types that correspond to internal 
features. I can see that it being desirable to continue to be able to do 
that, even if only for the purposes of experimentation. At present, 
those DLPI numbers typically relate to a more "normal" link type, such 
as DL_IPV4 (0x80000001) being LINKTYPE_IPV4 but others may not.

Darren

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.