[pcap-ng-format] What is the ordering for comment option strings?

Jasper Bongertz jasper at packet-foo.com
Sat Aug 22 23:50:45 UTC 2015


Sunday, August 23, 2015, 12:43:17 AM, Hadriel Kaplan wrote:

> Within a block, is the first comment option the oldest or most-recent?

> I.e., if a new comment is added to a block by a pcapng merging or
> manipulating application, should it get appended or prepended?

My first reaction was to append most-recent, meaning that the oldest
comment comes first when reading options sequentially.

It's probably a question of personal preference, but we should define
it (and require programs that read a file and writes it back to disk
to keep that order intact). Wording needs to be precise to avoid
confusion, because order may be important in some cases.

Does anyone object to doing it in append mode?

Cheers,
Jasper
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3681 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150823/c8b16deb/attachment.bin>


More information about the pcap-ng-format mailing list