[pcap-ng-format] reserving blocks

Guy Harris guy at alum.mit.edu
Tue Feb 11 02:08:08 UTC 2014


On Feb 10, 2014, at 9:07 AM, Loris Degioanni <loris.degioanni at gmail.com> wrote:

> On Sun, Feb 9, 2014 at 11:24 PM, Guy Harris <guy at alum.mit.edu> wrote:
> 
>> So what *are* the different semantics?  Does the Interface List Block show *all* interfaces, *including* interfaces on which the capture was *not* done?
> 
> Correct.

So what happens if new interfaces appear on the system after the capture starts?  Could a new ILB get written that overrides the previous one (which could also be done if interfaces *disappear* after the capture starts)?  If not, that means the ILB indicates what interfaces exist at the time the capture started, but doesn't necessarily indicate what interfaces existed throughout the capture.


More information about the pcap-ng-format mailing list