[pcap-ng-format] What is the ordering for comment option strings?
Guy Harris
guy at alum.mit.edu
Sat Aug 22 22:52:56 UTC 2015
On Aug 22, 2015, at 3:44 PM, Guy Harris <guy at alum.mit.edu> wrote:
> On Aug 22, 2015, at 3:43 PM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:
>
>> Within a block, is the first comment option the oldest or most-recent?
>>
>> I.e., if a new comment is added to a block by a pcapng merging or
>> manipulating application, should it get appended or prepended?
>
> I would vote for "appending".
Definitely for explicitly adding new comments to a file.
For *merging*, that would presumably apply only to blocks that would be combined as a result of the merge process, such as Section Header Blocks. In that case, the order would not have any real significance; It Might Be Nice to somehow flag the section as being the result of a merger, and somehow be able to, for example, indicate something about the original files, so that a comment could be flagged as coming from a particular source file.
That might apply to options *other* than comments.
More information about the pcap-ng-format
mailing list