Re: How to record plain text in a pcap file?

[Darren Reed <Darren.Reed () Oracle COM>]

Guy Harris wrote:
> On Apr 4, 2011, at 10:09 PM, Darren Reed wrote:
>
>   
> > Is there a DLT type for "plain text"?
> >     
>
> No.
>
>   
> > That is, can I record or insert text based comments or other data to a pcap file?
> >     
>
> No, but you can record them in a pcap-NG file.
>   

My reading of your list of tradeoffs is that even for pcap-NG, 
LINKTYPE_TEXT is required as it has no other way to record text (no 
comment fields, for example, attached to packet blocks.)

The handling of the presence of LINKTYPE_TEXT will be the same for any 
other link type that is unknown to the tools that encounter it, so 
there's nothing new or special about that.

For that matter, it may be worthwhile improving the failure modes of 
tcpdump, if only in dealing with LINKTYPE_PPI.

So I'll ask, does anyone think that LINKTYPE_TEXT should not be added?

Darren

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.