Re: proposed tcpdump dinner @IETF55

[Guy Harris <gharris () sonic net>]

On Mon, Nov 11, 2002 at 05:29:33PM -0600, David Young wrote:
> I knew that people desired sync, but I did not know there was a plan.
> NetBSD's libpcap/tcpdump appears to be out of sync with the generic
> version.

Speaking of NetBSD, a patch to tcpdump was submitted by Kazushi Sugyo;
part of the patch changes print-esp.c, with a comment

        /* FCS included at end of frame (NetBSD 1.6 or later) */

It would be nice if, for link-layer types that have historically not
supplied FCS values, the DLT_ value indicated whether the frame
delivered to BPF included an FCS, so that programs looking at the frames
would know whether to assume the frame data includes an FCS or not.

(It might also be nice if a new BPF header were introduced that included
packet flags to indicate stuff such as:

        whether the packet was sent by the machine, received by the
        machine as a unicast, received by the machine as a multicast,
        received by the machine as a broadcast, received promiscuously,
        or "don't know";

        what errors the frame had, if any.

The first would be useful for PPP so that decoders that have to keep
track of which direction the frame was in - e.g., to keep track of
compression in two directions - could do so.  It might also be nice for
other link layers; Linux supplies that information in PF_PACKET sockets,
so I guess *somebody* might use it.

The latter would be useful on, for example, those platforms and network
interfaces where BIOCPROMISC not only turns promiscuous mode on but also
tells the card to deliver packets that have errors.)
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe