[pcap-ng-format] Multiple SHBs in a file

Hadriel Kaplan the.real.hadriel at gmail.com
Fri Aug 21 23:08:47 UTC 2015


Hi,
Is there an actual, practical, use-case for having multiple Section
Header Blocks in a single PCAP-NG file?

It makes read-processing a file far more complicated, and I don't see
any real benefit in return - except maybe for a dumb "file merger"
which just concatenates SHB sections from separate files into one file
- but I'm not sure why we should complicate the file format for that
one action.

Is there any existing application which can truly read-process a file
with multiple SHBs? Is there an existing application which
generates/creates a file with multiple SHBs?

Because if not, I propose we get rid of it.

-hadriel


More information about the pcap-ng-format mailing list