Re: Proposed new pcap format

[Guy Harris <guy () alum mit edu>]

On Apr 13, 2004, at 3:38 PM, Darren Reed wrote:

> In each case the specification defines support for a number of 
> different
> hashes, of varying strengths and the choice is left to the end user to
> decide on what they wish to use.  I don't see why libpcap should be any
> different.

If the hash value is generated by the application, that's the case.

If it's generated by the kernel or libpcap, then the end user might not 
have much of a choice - they're stuck with what the kernel or libpcap 
provide.

I think Loris is saying that, for hashes generated by the kernel or 
libpcap (which, as I see it, are *NOT* the only hashes that will be 
supported in the file - an application could add its own hashes to a 
packet, and there's no *requirement* that the kernel or libpcap provide 
hashes for packets), we probably aren't going to provide the full 
panoply of hashes (on some platforms, the kernel won't provide any 
hashes at all).

That might not require us to choose a default, however, as long as the 
kernel can tell libpcap which hash value it's providing (if any).  It 
might, however, mean that we should choose a hash value that, for 
kernel hashing, is considered "adequate", and recommend that capture 
mechanisms implement it.

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.