[ntar-workers] PCAP-NG / Interface ID size / Drops Counter size ?
Hannes Gredler
hannes at juniper.net
Mon Mar 6 06:41:16 GMT 2006
Gianluca Varenni wrote:
> First of all, sorry for the long delay, I was really busy last weeks at
> work.
> Since captures do not span years (I think they span hours, days), an
> approach that came to my mind, *if* we want to use 64bit instead of 128
> bits for timestamps, is:
>
> 1. use timestamp(low)/(high) as the *actual* 32bit low/high parts of a
> 64 bit counter
> 2. maintain the spec of the precision of this timestamp as it is now in
> the IDB
> 3. add an option in the IDB that specifies an (optional) offset for the
> timestamps of packets related to that interface
>
> In this way you can for example store a capture with picosecond
> precision, with a maximum length of about 5000 hours (if my computations
> are not wrong).
>
> Any opinions on this?
gianluca,
i do think this is a nice tradeoff b/w overhead and extensibility and looks
good to me. - another question: did you have a look at the 16-bit vs 32-bit counter/index
issues that i was talking about earlier - any bright ideas would be welcome.
tx,
/hannes
More information about the ntar-workers
mailing list