Re: Request for a new DLT

["Fulko Hew" <fulko.hew () gmail com>]

On 7/18/07, Guy Harris <guy () alum mit edu> wrote:
> Fulko Hew wrote:
>
> > Well, I looked at it, and it sounds like a good idea, but it is
> > relatively heavy
> > weight (I only need to transport 4 bytes, and PPI has 8 bytes of overhead
> > (200% in my case)  So I'm going to graciously decline and still ask for
> > my own DLT called 'DLT_SITA'.
> >
> > (This also leave my options open for the future in monitoring other things
> > like STREAMs, named pipes, shared memory communications devices, etc.)
>
> So your 4-byte (or 5-byte, as per your original mail) header will be
> sufficient for that?  (Once you've picked a header format, you can't
> change it - you'd need a different DLT_ value for a different header, as
> the DLT_ value should be sufficient to allow a file to be interpreted.)

Yes, because as I see it, these other cases I can envision can/will then
be handled as part of the protocol stream and not as out-of-band data.
(Sorry, it is 5 bytes).

For example: Any future requirement seem to fit more into addressing
within a protocol just like MAC addresses are within an Ethernet frame.
Whereas my current requirements of framing errors and link level signalling
would be more akin to Ethernet's 'collision detect', or 'PHY unavailable'
(which currently isn't supportable).
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.