[pcap-ng-format] Reading and writing blocks you don't understand

[Michael Richardson]

Michael Tuexen <tuexen at wireshark.org> wrote:
    >> If you have a pcap-ng file with a section with a given endianness, and
    >> a program that reads a pcap-ng file, processes it in some fashion, and
    >> writes out a new file, what should that program do with blocks that it
    >> doesn't understand?

    > This is an interesting question... What about using some bits in the
    > block type to indicate what should be done. Basically one bit could
    > mean: * stop processing of the file or continue when reading Another
    > one could mean: * drop when writing or just copy it out.

Yes, have a critical bit in the option space.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     mcr at sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [