[pcap-ng-format] What is the ordering for comment option strings?

Hadriel Kaplan the.real.hadriel at gmail.com
Sat Aug 22 22:58:15 UTC 2015


Right now, as an example, mergecap creates its own SHB comment which
identifies the filenames it merged. It does not keep any of the
original files' SHB comments. It's on my to-do list to have it keep
the originals (append them in input file order), but I need to know
whether mergecap's own new comment should go first or last, which is
what got me thinking to ask the question.

-hadriel

On Sat, Aug 22, 2015 at 6:52 PM, Guy Harris <guy at alum.mit.edu> wrote:
>
> On Aug 22, 2015, at 3:44 PM, Guy Harris <guy at alum.mit.edu> wrote:
>
>> On Aug 22, 2015, at 3:43 PM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:
>>
>>> Within a block, is the first comment option the oldest or most-recent?
>>>
>>> I.e., if a new comment is added to a block by a pcapng merging or
>>> manipulating application, should it get appended or prepended?
>>
>> I would vote for "appending".
>
> Definitely for explicitly adding new comments to a file.
>
> For *merging*, that would presumably apply only to blocks that would be combined as a result of the merge process, such as Section Header Blocks.  In that case, the order would not have any real significance; It Might Be Nice to somehow flag the section as being the result of a merger, and somehow be able to, for example, indicate something about the original files, so that a comment could be flagged as coming from a particular source file.
>
> That might apply to options *other* than comments.
> _______________________________________________
> pcap-ng-format mailing list
> pcap-ng-format at winpcap.org
> https://www.winpcap.org/mailman/listinfo/pcap-ng-format


More information about the pcap-ng-format mailing list