[pcap-ng-format] Does anyone actually generate the epb_hash field today?

Hadriel Kaplan the.real.hadriel at gmail.com
Thu Aug 27 15:05:18 UTC 2015


Howdy,
I'm not suggesting we get rid of the option, but does any code out
there actually generate the EPB's epb_hash option?

I have not found any code which does, and it's under-specified in
terms of what the "algorithms" cover and how their values are encoded.
(and some of the algorithms seem ludicrous to me - in particular the
2's complement and XOR "algorithms")

I propose we remove them from the draft, but reserve their number
codes (not re-use them) just in case.

-hadriel


More information about the pcap-ng-format mailing list