Re: proposed new pcap format

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Michael Richardson, sie wrote:
-- Start of PGP signed section.
> This is what I would propose as revision.
> Note that the pcap1_packet_header is present on every packet. One can
> merge pcap files together with "cat" if one likes.
>
> A suggestion was made to accomodate the nano-second resolution from AIX.
> Can you tell me what they do for that? just more bits, sure, but is
> there a nano-seconds (32-bits, I guess) + seconds (64 bits?).
>
>
> enum pcap1_info_types {
>         PCAP_DATACAPTURE,
>       PCAP_TIMESTAMP,
> };

Can I please also ask for a PCAP_PRIVATE that is as follows:

struct pcap1_info_private {
      char pinfo_guid[4+2+2+8];
      char pinfo_data[0];
}

Thanks,
Darren
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe