[pcap-ng-format] TODO in pcap-ng specifications

[Jasper Bongertz]

Hi,

I could live without the IP addresses of the capture interface, but
apparently someone thought it would be nice to have :-)  I usually
capture with passive NICs anyway, but for those cases where you do a
local capture it could be helpful to identify that the system is setup
like that. If you see traffic to and from an IP which is the same as the
one of the capture interface you have a local capture setup.

I think a traffic generator should not write the interface IPs to a
capture if there are that many addresses used in a test. Last time I
checked even dumpcap doesn't write the IP of the capture interface to file.

Cheers,
Jasper

On 24.07.2012 16:28, Anders Broman wrote:
> Hi,
> One comment after a quick read trough
> if_IPv4addr multiple
> if_IPv6addr multiple
>
> Is the IP address(es) of the capturing interface of any interest?
> If the capture is of a span/mirror port or of a tap I guess not, we
have an SIP user traffic
> Generator which have > 13 0000 virtual IP addresses assigned to a
interface that'd mess up
> Any representation of IP addresses badly I think.
>
> Regards
> Anders
>
> -----Original Message-----
> From: pcap-ng-format-bounces at winpcap.org
[mailto:pcap-ng-format-bounces at winpcap.org] On Behalf Of Jasper Bongertz
> Sent: den 24 juli 2012 15:50
> To: Pcap-ng file format
> Subject: [pcap-ng-format] TODO in pcap-ng specifications
>
> Hi all,
>
> I've just spent a little time in the specs and searched for all TODOs
to see what can be done about them. I have created a text document with
my thoughts, and maybe some of you can take a look at it and we can
start a discussion about it to get things going.
>
> If nobody disagrees I will replace the simple TODO items (for the
examples mostly) in the SVN sometime end of this week.
>
> Cheers,
> Jasper
> _______________________________________________
> pcap-ng-format mailing list
> pcap-ng-format at winpcap.org
> https://www.winpcap.org/mailman/listinfo/pcap-ng-format


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20120725/ddb045c1/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4484 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20120725/ddb045c1/attachment.bin>