Re: Request for a new LINKTYPE_/DLT_ type.

[Guy Harris <gharris () sonic net>]

On Nov 28, 2018, at 4:34 AM, Dave Barach (dbarach) <dbarach () cisco com> wrote:

> The buffer index is an opaque 32-bit cookie which allows consumers of these data to easily filter/track single 
> packets as they traverse the forwarding graph. Multiple records per packet are normal, and to be expected.

In what form?

For example, might you see:

        an Ethernet packet, containing an IP datagram, containing a TCP segment or UDP datagram;

        an IP packet, containing the same IP datagram as the previous packet;

        a TCP segment or UDP datagram, containing the same segment/datagram as the previous packet;

or might you see the same {Ethernet,IP,TCP,UDP} packet more than once, or both?

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers