[pcap-ng-format] Need to figure out what to do with Experimental Blocks

Hadriel Kaplan the.real.hadriel at gmail.com
Tue Aug 25 16:59:00 UTC 2015


On Sat, Aug 22, 2015 at 7:43 PM, Jasper Bongertz <jasper at packet-foo.com> wrote:
>
> We can maybe think about completing
>
> - Compression Block
>   - need to define compression algorithms and compression type byte
>   - Maybe there is an interest for this as it can reduce file size
> without having to gz the whole pcapng file
>   - Wireshark/libpcap would have to support it to have any chance of being
> used

But why bother? I mean you can compress the whole file instead, which
would give much better compression ratios, and is already supported by
the various Wireshark tools. (as you well know)
What advantage does packet-by-packet compression give?

-hadriel


More information about the pcap-ng-format mailing list