[pcap-ng-format] TODO in pcap-ng specifications

[Anders Broman]

Guy Harris skrev 2012-07-25 04:06:
> On Jul 24, 2012, at 7:28 AM, Anders Broman wrote:
>
>> Hi,
>> One comment after a quick read trough
>> if_IPv4addr				multiple
>> if_IPv6addr				multiple
>>
>> Is the IP address(es) of the capturing interface of any interest?
>> If the capture is of a span/mirror port or of a tap I guess not, we have an SIP user traffic
>> Generator which have>  13 0000 virtual IP addresses assigned to a interface that'd mess up
>> Any representation of IP addresses badly I think.
> "Mess up" in the sense that you'd have an IDB with>  13000 options, I guess, but not "mess up" in the sense that you'd need a single option with 13000 addresses in it.
I was more thinking of the program "collecting" the information to be 
written or the program displaying
the option(s) to the user in a GUI.
> In any case, they're called "options", so a program writing out a pcap-ng file is under no obligation to list any of the addresses.
>
> And, in any case, the spec already says
>
>> This option can be repeated multiple times within the same Interface Description Block when multiple IPv4 addresses are assigned to the interface.
> for if_IPv4addr and
>
>> This option can be repeated multiple times within the same Interface Description Block when multiple IPv6 addresses are assigned to the interface.
> for if_IPv6addr, so it *already* says there can be more than one of them.
Yes for version 1.0 we are stuck with them but we might consider 
removing them in a later version
or at least put in a note that there may be a surprisingly large number 
of IP addresses and that implementers
may need to take care to handle that. As an example older Wireshark 
versions took minutes to start if
you had many IP addresses assigned to an interface.

Regards
Anders

> _______________________________________________
> pcap-ng-format mailing list
> pcap-ng-format at winpcap.org
> https://www.winpcap.org/mailman/listinfo/pcap-ng-format