[pcap-ng-format] What happens if an interface's attributes, as given in IDB options, change over the course of a capture?

Guy Harris guy at alum.mit.edu
Sat Jul 14 16:14:09 PDT 2012


I.e., what happens if, for example, you're capturing on an interface with a leased DHCP-assigned address and, when it tries to renew the lease, it gets a different address?  (Probably not a nice thing for the DHCP server to do, as it might, for example, disrupt existing TCP connections, but....)

Or if you start a capture, clamshell your laptop, take it elsewhere, and then open up the laptop on a different network, and the Wi-Fi interface gets a different IP address?

Some way of indicating a change to some of the IDB options for an interface (complete with time stamp?) might be useful.


More information about the pcap-ng-format mailing list