[pcap-ng-format] reserving blocks for decryption?

Anders Broman anders.broman at ericsson.com
Mon Feb 10 09:02:09 UTC 2014


Hi,
On the topic of new blocks how about "decryption blocks" the bug https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9616 uses the comments to store SSL decryption details.
I feel it would be better in a pcap-ng block. I'm also looking into IPsec ESP where it could be useful to have a decryption block. I haven't really thought about the format of such blocks.
Perhaps a generic decryption block with sub options per encryption protocol?

Regards
Anders



More information about the pcap-ng-format mailing list