[ntar-workers] On Markers and Bookmarks
Stephen Donnelly
stephen at endace.com
Thu Jun 30 21:34:25 GMT 2005
Christian Kreibich wrote:
> On Thu, 2005-06-30 at 13:32 -0700, Jose M. Gonzalez wrote:
>
>> /-----------\ /-\ /--\ /-\ /-\ /-\ /--\ /-\ /->
>> | || || || || || || || ||
>> +|------------+v|--+v|---+v|--+v|--+|---+|----+|---+|---+----
>> | PacketBlock | PB | REW | FF | PB | PB | REW | FF | PB | ...
>> +-------------+----+-----+^|--+----+----+-----+^|--+----+----
>> || ||
>> ---------------/ \-----------------/ \---->
>
>
> Damn Chema, stop competing with my ASCII art! ;)
>
> (The FWs/REWs are good stuff btw!)
>
>
>>Note: this is not indexing at all. I agree with Christian that indexing
>>is better done offline, in a separate file.
>
>
> No no, I want no separate files. I just want a dedicated type of block
> for indexing, essentially leaving it up the the application how indexing
> is done, and store such blocks in the SEB.
I agree, separate files are too ease to lose. Better to keep everything in
one place.
Allowing the indexing data to be added to the capture file in a post
processing step (if there is no time to do it at capture time) would seem a
better approach.
This could either be via fields that can be left blank/undefined at capture
time (still wastes space/bandwidth), or by inserting index records later
(requires recomputing and updating offsets in existing navigation fields).
Stephen.
--
-----------------------------------------------------------------------
Stephen Donnelly BCMS PhD email: sfd at endace.com
Endace Technology Ltd phone: +64 7 839 0540
Hamilton, New Zealand cell: +64 21 1104378
-----------------------------------------------------------------------
More information about the ntar-workers
mailing list