[ntar-workers] Re: Major rework / review of pcapng file formatinCVS - please review

[Gianluca Varenni]

----- Original Message ----- 
From: "Guy Harris" <guy at alum.mit.edu>
To: <ntar-workers at winpcap.org>
Sent: Monday, October 22, 2007 6:11 PM
Subject: Re: [ntar-workers] Re: Major rework / review of pcapng file 
formatinCVS - please review


>
> On Oct 22, 2007, at 2:44 PM, Gianluca Varenni wrote:
>
>> My bad, I was not clear at all here. My point is that we should  probably 
>> have a way in the fcslen option of the Interface  Description Block to 
>> say that the fcslen is per-packet, and it's  saved as a per-packet option 
>> (e.g. if_fcslen=0xFFFFFFF). Otherwise  the problem is that the if_fcslen 
>> (in the IDB) specifies a "default"  FCS, but then you would need to scan 
>> the per-packet options to know  if the effective FCS len for that packet 
>> is the "default" one or a  specific per-packet one. What I want is a way 
>> to say "ok, the FCS  len is fixed, 4 bytes. You will not find a 
>> per-packet FCSLEN in the  packet options." or "the FCS is per-packet. You 
>> need to read the per- packet options to know the effective FCS len. If 
>> you don't find it,  then the FCS len is the one stored in the IDB".
>
> What if there is no if_fcslen option?  Does that mean "no FCS" or  "check 
> the per-packet options to see what the FCS length is"?
>
> If so, then having an if_fcslen option could mean "ignore the FCS  length 
> in the per-packet options", although some applications will be  looking at 
> the flags anyway; we should probably say that the behavior  of a program 
> reading a pcap-NG file is undefined if a packet has a per- packet FCS 
> length that's not equal to the if_fcslen option's value, so  that an 
> application can either ignore the epb_flags option, process it  fully, or 
> process the FCS in it only if there's no if_fcslen option.

I think this is the best approach: if if_fcslen is present, the per-packet 
fcslen should not be written. If both are present, then the behavior of an 
app reading such file is undefined. If everyone is ok with this, I will add 
a note on this in the document.

GV



> _______________________________________________
> ntar-workers mailing list
> ntar-workers at winpcap.org
> https://www.winpcap.org/mailman/listinfo/ntar-workers