Re: Proposed new pcap format

["Ronnie Sahlberg" <ronnie_sahlberg () ozemail com au>]

----- Original Message ----- 
From: "Stephen Donnelly"
Sent: Wednesday, April 14, 2004 12:38 PM
Subject: Re: [tcpdump-workers] Proposed new pcap format


> > Yes, fully fledged decoded captures would use a lot of extra disk, but a
> > raw no-frills capture could be recorded with maybe only 50% or so
overhead.
> 50% extra space and 50% extra disk bandwidth cost? So my 250 Megabyte per
second
> pcap stream to disk becomes 375MB/s?

I would be extatic if the captures people send to me would be tiny 250
MByte.
Some people work with captures that are 1GByte in size and bigger.

I dont see really the benefit from using XML at all.
It is just another file format and other well defined TLV fileformats are
just as extensible.
The only aplications ever reading pcap files are always going to do that
through libpcap anyway so
XML or a better suited binary fileformat would be invisible to the
application anyway.

I think XML is the 21st centurys response to C++.


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.