Re: [tcpdump-workers] endianness of portable BPF bytecode (DRAFT revision 4)

2022-06-30 Thread Denis Ovsienko via tcpdump-workers
--- Begin Message --- Hello list. Below is revision 4 of the document, unless anyone objects it will be committed to libpcap repository soonish, this way any remaining improvements can be made there when and as necessary. Changes from the previous revision are as follows: * fixup letter case * r

Re: [tcpdump-workers] endianness of portable BPF bytecode (DRAFT revision 3)

2022-06-25 Thread Denis Ovsienko via tcpdump-workers
--- Begin Message --- Hello list. Below you can find the next draft revision. It incorporates some feedback received from Guy and Michael, also it reorders the TLVs and adds SnapLen TLV, Netmask TLV and EOF TLV. Also the text has been converted to a man page, so it could live next to pcap-savefi

Re: [tcpdump-workers] endianness of portable BPF bytecode

2022-06-11 Thread Denis Ovsienko via tcpdump-workers
--- Begin Message --- On Sat, 11 Jun 2022 10:51:41 -0400 Michael Richardson wrote: > Denis Ovsienko via tcpdump-workers > wrote: > > Below is a draft of such a file format. It addresses the > > following needs: > > * There is a header with a signature string to avoid false > > p

Re: [tcpdump-workers] endianness of portable BPF bytecode

2022-06-10 Thread Denis Ovsienko via tcpdump-workers
--- Begin Message --- On Fri, 10 Jun 2022 14:26:34 -0700 Guy Harris wrote: > On Jun 10, 2022, at 1:59 PM, Denis Ovsienko via tcpdump-workers > wrote: > > > Below is a draft of such a file format. It addresses the following > > needs: > > * There is a header with a signature string to avoid fal

Re: [tcpdump-workers] endianness of portable BPF bytecode

2022-06-10 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On Jun 10, 2022, at 1:59 PM, Denis Ovsienko via tcpdump-workers wrote: > Below is a draft of such a file format. It addresses the following > needs: > * There is a header with a signature string to avoid false positive > detection as some other file type that begins exact

Re: [tcpdump-workers] endianness of portable BPF bytecode

2022-06-10 Thread Denis Ovsienko via tcpdump-workers
--- Begin Message --- On Thu, 2 Jun 2022 20:58:38 +0100 Denis Ovsienko via tcpdump-workers wrote: > If there is no convention in place yet, I would like to propose > declaring big-endian as the implicit/default byte order, then > particular file format(s) with headers can override that as needed.