[pcap-ng-format] Multiple SHBs in a file

[Gianluca Varenni]

The original reason for multiple SHBs is exactly the one you mentioned i.e. being able to concatenate two files by just using "cat" or similar. With pcap, you need to have some tool to manually do that. And I agree, having to manage multiple SHBs in a file is a major pain, because every section has its own interfaces and it might even have different byte orders. I did implement support for it in NTAR, it was painful. At the same time, if you don't use multiple SHBs in a file, you can wonder why you have an SHB in the file to begin with...

-----Original Message-----
From: pcap-ng-format-bounces at winpcap.org [mailto:pcap-ng-format-bounces at winpcap.org] On Behalf Of Hadriel Kaplan
Sent: Friday, August 21, 2015 4:09 PM
To: Pcap-ng file format
Subject: [pcap-ng-format] Multiple SHBs in a file

Hi,
Is there an actual, practical, use-case for having multiple Section Header Blocks in a single PCAP-NG file?

It makes read-processing a file far more complicated, and I don't see any real benefit in return - except maybe for a dumb "file merger"
which just concatenates SHB sections from separate files into one file
- but I'm not sure why we should complicate the file format for that one action.

Is there any existing application which can truly read-process a file with multiple SHBs? Is there an existing application which generates/creates a file with multiple SHBs?

Because if not, I propose we get rid of it.

-hadriel
_______________________________________________
pcap-ng-format mailing list
pcap-ng-format at winpcap.org
https://www.winpcap.org/mailman/listinfo/pcap-ng-format