-----BEGIN PGP SIGNED MESSAGE-----
>>>>> "Christian" == Christian Kreibich <[EMAIL PROTECTED]> writes:
>> That's a nice feature, and one we should try to maintain if
>> possible.
Christian> There's another thing I'd like to point out: the new
Christian> scheme, in its current state, doesn't provide the snaplen
Christian> value that the old pcap_file_header provides. I think a
Christian> *lot* of applications use that value to allocate a buffer
Christian> to store packet data before starting to read packets.
At most, it could be a hint of a likely size, if we support any method
of concatenating files.
We could perhaps have a "ranlib"-like tool that walked a pcap file to
optomize the hint at the beginning.
Christian> I agree that the ability to cat together trace files
Christian> would be nice. However if that's the only benefit, while
Christian> otherwise every packet-iterating application becomes a
Christian> whole lot more complicated because it must find a way to
Christian> deal with pure metadata without any packet data at random
Having every part of the file being identical in structure has a lot
of benefits in my opinion.
There are numerous times when I wanted to do stuff like:
( tcpdump -r file1 -w - filespec1;
tcpdump -r file1 -w - filespec2 ) | analysis-program
Often this occurs for me in writing test cases, but also in trying to
understand what has broken in a network.
- --
] ON HUMILITY: to err is human. To moo, bovine. | firewalls [
] Michael Richardson, Xelerance Corporation, Ottawa, ON |net architect[
] [EMAIL PROTECTED] http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys
iQCVAwUBQHqry4qHRg3pndX9AQFIdwP9HZYJr2FGc4KICi1GH5C0WbzomWsfdVx1
xMeRM8mWuCXsqKexR+Dx99Ldc1MBFUbznErtSHtBfSUJcXrv2eefawrMNo0jxHJ2
KQj/+JHGgaKN6x/en+K3HpatDk/9iMuHO5NXqO0CzHUIAow2eY+IaKMAl91ry4/9
RhyE9Fj4nVQ=
=AMsR
-----END PGP SIGNATURE-----
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
