- Original Message -
From: "Felipe Kellermann" <[EMAIL PROTECTED]>
To:
Sent: Sunday, February 20, 2005 9:44 PM
Subject: Re: [tcpdump-workers] PCAP-NG suggestion
On Sun, 20 Feb 2005 7:21pm +0100, Gianluca Varenni wrote:
Uhm. At first, I thought it was a great idea.
On Sun, 20 Feb 2005 7:21pm +0100, Gianluca Varenni wrote:
> Uhm. At first, I thought it was a great idea. Now I have some doubts:
> basically you are saving packets using the "stardard" packet block, but only
> your custom app will be able to use the trace file and dissect the packets,
> since yo
Gianluca Varenni wrote:
- Original Message - From: "Felipe Kellermann" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, February 09, 2005 2:08 AM
Subject: Re: [tcpdump-workers] PCAP-NG suggestion
On Sun, 13 Feb 2005 2:28pm -0800, Loris Degioanni wrote:
I think a block with dat
- Original Message -
From: "Felipe Kellermann" <[EMAIL PROTECTED]>
To: "Tcpdump Workers Mailing List"
Sent: Wednesday, February 09, 2005 2:04 AM
Subject: Re: [tcpdump-workers] PCAP-NG suggestion
On Sun, 13 Feb 2005 12:41pm +0100, Gianluca Varenni wrote:
I
- Original Message -
From: "Felipe Kellermann" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, February 09, 2005 2:08 AM
Subject: Re: [tcpdump-workers] PCAP-NG suggestion
On Sun, 13 Feb 2005 2:28pm -0800, Loris Degioanni wrote:
I think a block with data that starts at an ar
On Mon, 14 Feb 2005 5:29pm -0800, Guy Harris wrote:
> It is? Not for me - I need an explanation
>
By "self-explanatory" I mean only the purpose of the feature -- not the
definitions. That surely demands a lot more thought, opinions, etc.
> > and in the old format it would be something l
On Feb 9, 2005, at 8:46 PM, Felipe Kellermann wrote:
I've recently read the draft of the new file format -- very
interesting.
I'd like to raise a question here on a feature I've always thought
would
be useful: An offset, in addition to the snaplen. This feature is
surely
almost self-explanatory
On Sun, 13 Feb 2005 2:28pm -0800, Loris Degioanni wrote:
> I think a block with data that starts at an arbitrary position of the packet
> would be useful, but it would be impossible (or at least hard) for the typical
> sniffer like Ethereal or tcpdump to dissect it. A possible solution could be
>
On Sun, 13 Feb 2005 12:41pm +0100, Gianluca Varenni wrote:
> I haven't yet thought if it would be better to add it as an option, or as a
> field of the IDB.
I think it would be better placed before the snaplen field in the IDB. The
reason is that it would ease the decision of the parsers in fin
m: "Felipe Kellermann" <[EMAIL PROTECTED]>
To: "Tcpdump Workers Mailing List"
Sent: Thursday, February 10, 2005 5:46 AM
Subject: [tcpdump-workers] PCAP-NG suggestion
Hi,
I've recently read the draft of the new file format -- very interesting.
I'd like to raise a
ump Workers Mailing List"
Sent: Thursday, February 10, 2005 5:46 AM
Subject: [tcpdump-workers] PCAP-NG suggestion
Hi,
I've recently read the draft of the new file format -- very interesting.
I'd like to raise a question here on a feature I've always thought would
be useful: An
Hi,
I've recently read the draft of the new file format -- very interesting.
I'd like to raise a question here on a feature I've always thought would
be useful: An offset, in addition to the snaplen. This feature is surely
almost self-explanatory and in the old format it would be something like
12 matches
Mail list logo
