Re: proposed new pcap format

[Guy Harris <guy () alum mit edu>]

On Mar 27, 2004, at 9:15 PM, Michael Richardson wrote:

>   Do these need to be in every packet?  Maybe it is just meta-data that
> needs to be added at the beginning, perhaps along with the filter code.

The packet direction and, for received packets, an indication of how it 
was received, would be per-packet.

The FCS length, at least for PPP, can change over time if a different 
FCS length is negotiated, so that wouldn't be per-interface - and if 
it's also used as an indication of whether the FCS is present at all on 
LANs (outgoing packets wouldn't have an FCS; incoming packets might or 
might not have them depending on the driver), that could be 
per-interface as a flag indicating whether incoming packets have them, 
but if it's going to be per-packet anyway....

Error flags such as "bad CRC", "runt frame", etc. would be per-packet.

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.