[pcap-ng-format] What is the ordering for comment option strings?

Guy Harris guy at alum.mit.edu
Sat Aug 22 22:52:56 UTC 2015


On Aug 22, 2015, at 3:44 PM, Guy Harris <guy at alum.mit.edu> wrote:

> On Aug 22, 2015, at 3:43 PM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:
> 
>> Within a block, is the first comment option the oldest or most-recent?
>> 
>> I.e., if a new comment is added to a block by a pcapng merging or
>> manipulating application, should it get appended or prepended?
> 
> I would vote for "appending".

Definitely for explicitly adding new comments to a file.

For *merging*, that would presumably apply only to blocks that would be combined as a result of the merge process, such as Section Header Blocks.  In that case, the order would not have any real significance; It Might Be Nice to somehow flag the section as being the result of a merger, and somehow be able to, for example, indicate something about the original files, so that a comment could be flagged as coming from a particular source file.

That might apply to options *other* than comments.


More information about the pcap-ng-format mailing list