Re: [tcpdump-workers] RFC: DLT for "application TCP stream capture"

2015-01-14 Thread Paul "LeoNerd" Evans
On Tue, 13 Jan 2015 19:32:46 -0800 Guy Harris wrote: > LINKTYPE_IP_PAYLOAD, or something such as that, with a link-layer > (pseudo-)header containing: I'm happy with that as a name. > an indication of whether the network-layer addresses are IPv4 > or IPv6; > > source address; > >

Re: [tcpdump-workers] RFC: DLT for "application TCP stream capture"

2015-01-14 Thread Michael Richardson
"Paul \"LeoNerd\" Evans" wrote: > I wonder though, whether the flags could be combined with the IP > version field, given as the version in the underlying (real) IP packet > anyway is only a 4-bit field. > 1 byte | Flags and IP version: > bit7 [ ...W ] bit0 > VV

Re: [tcpdump-workers] RFC: DLT for "application TCP stream capture"

2015-01-14 Thread Paul "LeoNerd" Evans
On Wed, 14 Jan 2015 11:57:53 -0500 Michael Richardson wrote: > > It does momentarily seem wasteful to repeat the > > source/destination information in every single packet > > (especially in the case of IPv6 with its 256bits of addressing > > information). Though I don't know if th

Re: [tcpdump-workers] RFC: DLT for "application TCP stream capture"

2015-01-14 Thread Paul "LeoNerd" Evans
On Wed, 14 Jan 2015 11:57:53 -0500 Michael Richardson wrote: > > It does momentarily seem wasteful to repeat the > > source/destination information in every single packet > > (especially in the case of IPv6 with its 256bits of addressing > > information). Though I don't know if th

Re: [tcpdump-workers] RFC: DLT for "application TCP stream capture"

2015-01-14 Thread Denis Ovsienko
>Eventually, we'll be using this format to debug multi-path TCP, in which case >the IP addresses (and maybe even the IP4/IP6-ness of it) might change. Also there exists SCTP, which implements the concept of variable (0..65535) number of "streams" for each direction of an "association" between a

Re: [tcpdump-workers] RFC: DLT for "application TCP stream capture"

2015-01-14 Thread Michael Tuexen
> On 14 Jan 2015, at 18:19, Denis Ovsienko wrote: > >> Eventually, we'll be using this format to debug multi-path TCP, in which >> case >> the IP addresses (and maybe even the IP4/IP6-ness of it) might change. > > Also there exists SCTP, which implements the concept of variable (0..65535) >

Re: [tcpdump-workers] RFC: DLT for "application TCP stream capture"

2015-01-14 Thread Guy Harris
On Jan 14, 2015, at 12:10 PM, Michael Tuexen wrote: >> On 14 Jan 2015, at 18:19, Denis Ovsienko wrote: >> >>> Eventually, we'll be using this format to debug multi-path TCP, in which >>> case >>> the IP addresses (and maybe even the IP4/IP6-ness of it) might change. >> >> Also there exist