proposed new pcap format

[Michael Richardson <mcr () sandelman ottawa on ca>]

-----BEGIN PGP SIGNED MESSAGE-----


This is what I would propose as revision. 
Note that the pcap1_packet_header is present on every packet. One can
merge pcap files together with "cat" if one likes.

A suggestion was made to accomodate the nano-second resolution from AIX.
Can you tell me what they do for that? just more bits, sure, but is
there a nano-seconds (32-bits, I guess) + seconds (64 bits?).


enum pcap1_info_types {
        PCAP_DATACAPTURE,
        PCAP_TIMESTAMP,
};

struct pcap1_info_container {
        bpf_u_int32 info_len;         /* in bytes */
        bpf_u_int32 info_type;        /* enum pcap1_info_types */
        unsigned char info_data[0];
};

struct pcap1_info_timestamp {
        struct pcap1_info_container pic;
        bpf_int32      thiszone;        /* gmt to local correction */
        struct timeval ts;      /* time stamp */
        bpf_u_int32 sigfigs;    /* accuracy of timestamps */
};      
        
struct pcap1_info_packet {
        struct pcap1_info_container pic;
        bpf_u_int32 caplen;     /* length of portion present */
        bpf_u_int32 len;        /* length this packet (off wire) */
        bpf_u_int32 linktype;   /* data link type (LINKTYPE_*) */
        unsigned char packet_data[0];
};      
        
struct pcap1_packet_header {
        bpf_u_int32 magic;
        u_short     version_major;
        u_short     version_minor;
        bpf_u_int32 block_len;
        struct pcap1_info_container pics[0];
};

- --
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr () xelerance com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBQGDqJoqHRg3pndX9AQGBxQQA0VQCx+5wekBavlTrGr/AFcpusN81Ecck
eQ3wbumeyRBRzt0N8bfCLoyA+BycHDCXE30Y7DCLODPFe7LUL1/BJelNgiAz2MJE
r1Nlg7JBe9X/jHNsZzzjhTlpK8UFLSYCgelQSSP1c0XtWWdrAO8yMTcTqn9Jz/4E
A7gaQb7ONb4=
=iLaD
-----END PGP SIGNATURE-----
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe