On 5/05/11 01:42 PM, Guy Harris wrote:
On May 5, 2011, at 1:38 PM, Darren Reed wrote:
In terms of pcap, I'm becoming more and more of the opinion that DLT_PPI should
not be used for anything other than DLT_IEEE802_11.
Sounds good to me.
Why am I not very interested in pcap-ng?
"The pcapng file format specification is still work in progress, see:"
... moving target.
pcap-ng is extensible, so it's *always* going to be a moving target. However,
both Wireshark and libpcap read it, so there are limits on how much it can
move; the spec needs to be clarified to indicate what part isn't going to
change and what part is.
Looking through it, the first observation I'd make is that there should
not have been any 16 bit fields. The one that concerns me most is the
IDB which has a 16bit link type.
On Solaris, we're using numbers above 0x80000000 to represent a
"private" number space for DLPI link types that correspond to internal
features. I can see that it being desirable to continue to be able to do
that, even if only for the purposes of experimentation. At present,
those DLPI numbers typically relate to a more "normal" link type, such
as DL_IPV4 (0x80000001) being LINKTYPE_IPV4 but others may not.
Darren
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
