[pcap-ng-format] Proposing new block type for PCAP-NG (UNCLASSIFIED)

Jasper Bongertz jasper at packet-foo.com
Wed Apr 1 19:26:49 UTC 2015


> On Apr 1, 2015, at 7:26 AM, Michael Richardson <mcr at sandelman.ca> wrote:

>> So as I understand, you are saying that we are adding a layer of indirection
>> in order to avoid repeating information, and so we'll have to manage the
>> indexes when we merge files.

> Yes, just as we have to do with Interface Description Blocks when we merge files.

BTW, if anyone ever needs to talk to someone who had to merge IDBs - I
have plenty of experience through coding TraceWrangler... it's a
challenge, and I'm still not sure if I got it right :-)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3681 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150401/e5aa5685/attachment.bin>


More information about the pcap-ng-format mailing list