[ntar-workers] Anonymization Support

[Guy Harris]

On Jun 30, 2005, at 2:20 PM, Jose M. Gonzalez wrote:

> Another interesting feature in the NTAR model would be some sort of  
> support
> for anonymization. At minimum, I'd appreciate being able to know  
> whether
> any sort of anonymization has been carried out in the trace. Maybe an
> ASCII option in the IDB that explains what was done.

Why the IDB?  Anonymization isn't necessarily per-interface.

And why does anonymization need a special type of flag?  I think  
multiple comment options are supported for blocks, so an anonymizer  
could add one to the SDB saying "IP and MAC addresses anonymized by  
TraceScrubber 1.5" or whatever, and that wouldn't overwrite, say, a  
comment added by the user doing the capture saying "Trace of HTTPS  
problem with IE 7.0" or whatever.