[pcap-ng-format] TODO in pcap-ng specifications

[Guy Harris]

On Jul 24, 2012, at 8:02 PM, Guy Harris wrote:

> On Jul 24, 2012, at 6:50 PM, Richard Sharpe wrote:
> 
>> Appendix D. Link Layer Headers.
>> 
>> I think we can fill this in easily ... perhaps.
> 
> Remove appendices C and D, and replace
> 
> 	• LinkType: a value that defines the link layer type of this interface. The list of Standardized Link Layer Type codes is available in Appendix C.
> 
> in 3.2 "Interface Description Block (mandatory)" with
> 
> 	• LinkType: a value that defines the link-layer header type of this interface.  See http://www.tcpdump.org/linktypes.html for the valid link-layer header types and descriptions of the packet contents for packets with those link-layer header types.

...and replace

	• Packet Data: the data coming from the network, including link-layer headers. The actual length of this field is Captured Len. The format of the link-layer headers depends on the LinkType field specified in the Interface Description Block (see Section 3.2) and it is specified in Appendix D.

in 3.3 "Enhanced Packet Block (optional)" and

	• Packet Data: the data coming from the network, including link-layer headers. The format of the link-layer headers depends on the LinkType field specified in the Interface Description Block (see Section 3.2) and it is specified in Appendix D. The actual length of this field is Captured Len.

in 3.5 "Packet Block (obsolete!)" with

	• Packet Data: the data coming from the network, including link-layer headers. The actual length of this field is Captured Len. The format of the link-layer headers depends on the LinkType field specified in the Interface Description Block (see Section 3.2), as per http://www.tcpdump.org/linktypes.html.

and, while we're at it, replace

	• Packet Data: the data coming from the network, including link-layers headers. The length of this field can be derived from the field Block Total Length, present in the Block Header, and it is the minimum value among the SnapLen (present in the Interface Description Block) and the Packet Len (present in this header).

in 3.4 "Simple Packet Block (optional)" with

	• Packet Data: the data coming from the network, including link-layer headers. The length of this field can be derived from the field Block Total Length, present in the Block Header, and it is the minimum value among the SnapLen (present in the Interface Description Block) and the Packet Len (present in this header). The format of the link-layer headers depends on the LinkType field specified in the Interface Description Block (see Section 3.2), as per http://www.tcpdump.org/linktypes.html.

so that all packet block descriptions point to http://www.tcpdump.org/linktypes.html (and so that "link-layers headers" is fixed to be "link-layer headers").