Re: Proposed new pcap format

["Ronnie Sahlberg" <ronnie_sahlberg () ozemail com au>]

----- Original Message ----- 
From: "Michael Richardson"
Sent: Tuesday, April 13, 2004 12:58 AM
Subject: Re: [tcpdump-workers] Proposed new pcap format


> -----BEGIN PGP SIGNED MESSAGE-----
>
>
> > > > > > "Darren" == Darren Reed writes:
>     Darren> Today, some people might want MD-5, others SHA-1 and in the
>     Darren> future, there may be other hashing algorithms that are
>     Darren> better to use.  And there are times when we might want it
>     Darren> off (algorithm 0, for example.)
>
>   okay, meta-data.
>   I think that one might want to emit the meta-data header, but not fill
> it in in some cases, and calculate the hash later on, poking it in.

That would work for me.  No need to make the kernel waste time on
calculating these hashes if
a userspace tool could do it offline afterwards, as long as the pcap file
format allows for them to be stored inside the file.


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.