[pcap-ng-format] Does PCAPNG have just one version number?

[Erik Hjelmvik]

2013/4/1 Guy Harris <guy at alum.mit.edu>

>
> On Apr 1, 2013, at 6:30 AM, Paul Long <Paul.Long at microsoft.com> wrote:
>
> > We want to display an appropriate version for PCAPNG files.  For
> instance for Netmon .cap, we have various version we could show.  My take
> is that you can have multiple PCAPNG version headers, so I’m assuming there
> is no ONE version to display.
>
> A pcap-ng file can be composed of multiple sections (the intent here is to
> allow files to be concatenated by a tool such as UN*X's cat command), each
> with its own Section Header Block, so, in theory, there could be multiple
> versions.
>
> If you haven't read the entire file, showing the version from the first
> section, and noting that it's just the first section, might be appropriate.
>  If you have read the entire file, showing a list of versions might be the
> right thing to do.
>

My guess is that 99.9% of all PCAPNG files will have just one SHB or
multiple SHB's with the same version number. So displaying just the
[MAJOR].[MINOR] version number of the first SHB should be adequate.

-- 
likes: http://pcapng.com
blog: http://www.netresec.com/?page=Blog
twitter: http://twitter.com/netresec
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20130401/36099122/attachment.html>