Re: RFC: DLT for "application TCP stream capture"

["Paul \"LeoNerd\" Evans" <leonerd () leonerd org uk>]

On Wed, 14 Jan 2015 11:57:53 -0500
Michael Richardson <mcr () sandelman ca> wrote:

>     > It does momentarily seem wasteful to repeat the
>     > source/destination information in every single packet
>     > (especially in the case of IPv6 with its 256bits of addressing
>     > information). Though I don't know if that outweighs the
>     > statefulness and added complexity of representing "flow setup"
>     > operations and "more bytes of data sent/received on this flow"
>     > as extra frame types.
>
> Eventually, we'll be using this format to debug multi-path TCP, in
> which case the IP addresses (and maybe even the IP4/IP6-ness of it)
> might change.
>
> And gzip'ed those addresses will compress quite easily.

OK, so I'll stick with the simplicity of just repeating it for every
frame then.

-- 
Paul "LeoNerd" Evans

leonerd () leonerd org uk
http://www.leonerd.org.uk/  |  https://metacpan.org/author/PEVANS
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers