[pcap-ng-format] Pcap-ng file with no IDBs

[Guy Harris]

On Aug 20, 2015, at 6:04 AM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:

> the current draft states in several places that a Pcap-ng file must
> have at least one IDB in the file, but does anyone object to changing
> this to instead allow a file to have no IDB if it has no packet blocks
> or any block which requires an IDB (e.g., an ISB)?

This might happen if, for example, you have a capturing process that waits for interfaces to appear and, when they do, puts an IDB into the file for it if there isn't one already there and then starts capturing on it, and that process is started on a machine with no interfaces available and stops without any new interfaces having arrived.

It might also be the case if pcap-ng is used to record events other than packets.