Re: Proposed new pcap format

["Loris Degioanni" <loris () netgroup-serv polito it>]

Ok, I'm going to add a 8-byte hash option for the packet block. Can anybody
suggest the hashing algorithm?


Loris

> In some email I received from Ronnie Sahlberg, sie wrote:
> > Oh, I forgot.
> >
> > Another useful thing to have is an option for the packet block where one
> > would store
> > a reasonably collission-safe 8-byte hash of the packet data.
> >
> > This would make it much easier to compare two different capture files to
see
> > where packets are missing etc.
>
> I'll agree that this, as part of the per-packet header, would be a useful
> addition to the pcap format.  No need for chained hashing, just
per-record.
> Darren
> -

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.