[ntar-workers] PCAP-NG / Interface ID size / Drops Counter size ?

Hannes Gredler hannes at juniper.net
Mon Mar 6 06:41:16 GMT 2006



Gianluca Varenni wrote:
> First of all, sorry for the long delay, I was really busy last weeks at 
> work.
> Since captures do not span years (I think they span hours, days), an 
> approach that came to my mind, *if* we want to use 64bit instead of 128 
> bits for timestamps, is:
> 
> 1. use timestamp(low)/(high) as the *actual* 32bit low/high parts of a 
> 64 bit counter
> 2. maintain the spec of the precision of this timestamp as it is now in 
> the IDB
> 3. add an option in the IDB that specifies an (optional) offset for the 
> timestamps of packets related to that interface
> 
> In this way you can for example store a capture with picosecond 
> precision, with a maximum length of about 5000 hours (if my computations 
> are not wrong).
> 
> Any opinions on this?

gianluca,

i do think this is a nice tradeoff b/w overhead and extensibility and looks
good to me. - another question: did you have a look at the 16-bit vs 32-bit counter/index
issues that i was talking about earlier - any bright ideas would be welcome.

tx,

/hannes


More information about the ntar-workers mailing list