tcpdump mailing list archives
Re: Proposed new pcap format
From: "Loris Degioanni" <loris () netgroup-serv polito it>
Date: Sun, 11 Apr 2004 21:56:30 -0700
Hi,
3.3 the packet block has a description of which interface the packet was captured on. It should also have a mandatory flag that describes whether we picked
the
packet from Rx or Tx on the interface. This should be a mandatory field in the header (1 bit) and not optional.I'd prefer a general flag field, which would include a direction indication (which might also include, for received packets, an indication of how it was received, e.g. unicast/multicast/broadcast/promiscuous/not specified), and could also include some other information (length of FCS, with 0 meaning "absent", and possibly link-layer-type-dependent error flags such as "runt frame", "bad CRC", etc.).
The problem is: all this information is not granted to be present, so you need to define default values, which in most cases mean "0", or "not available", or "absent". At this point why not using options? Loris - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- Re: Libpcap question, (continued)
- Re: Libpcap question Guy Harris (Apr 16)
- RE : Libpcap question Jacky Buyck (Apr 18)
- Re: Proposed new pcap format Guy Harris (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 14)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 14)
- Re: Proposed new pcap format Jefferson Ogata (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 14)
- Re: Proposed new pcap format Guy Harris (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Michael Richardson (Apr 16)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 11)
- Re: Proposed new pcap format Loris Degioanni (Apr 13)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Hannes Gredler (Apr 14)
- Re: Proposed new pcap format Fulvio Risso (Apr 14)
- Re: Proposed new pcap format Ronnie Sahlberg (Apr 11)
- Re: Proposed new pcap format Loris Degioanni (Apr 13)
- Re: Proposed new pcap format Fulvio Risso (Apr 13)
- Re: Proposed new pcap format Michael Richardson (Apr 16)