Re: Proposed new pcap format

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Ronnie Sahlberg, sie wrote:
> Oh, I forgot.
>
> Another useful thing to have is an option for the packet block where one
> would store
> a reasonably collission-safe 8-byte hash of the packet data.
>
> This would make it much easier to compare two different capture files to see
> where packets are missing etc.

I'll agree that this, as part of the per-packet header, would be a useful
addition to the pcap format.  No need for chained hashing, just per-record.

Darren
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.