[pcap-ng-format] Separate options for "user" and "vendor" descriptions of an interface?

Guy Harris guy at alum.mit.edu
Mon Jan 26 21:22:14 UTC 2015


The if_description option in the Interface Description Block is specified as containing "A UTF-8 string containing the description of the device used to capture data".  The examples given are "Broadcom NetXtreme" / "First Ethernet Interface" / ....

The first of those is a description of the device's hardware.  WinPcap supplies a description of that sort, as provided by the vendor's device driver; that won't necessarily distinguish between interfaces, if you have multiple interfaces of the same type.

The second of those is a user-oriented description.  Wireshark currently has code to get user-oriented descriptions from the OS on Windows ("Local Area Connection" and the like) and OS X, and, on FreeBSD and OpenBSD, libpcap uses those OSes ioctls that get a settable description string.

So I can see two different description options for an interface.  (Wireshark also lets the user specify their own names for an interface; this can be useful if the OS doesn't itself provide user-oriented descriptions, and also lets the user replace those with their own descriptions.  If they want to specify their own string *in addition to* a system-supplied user-oriented description, that's probably best done with comment options.)

I suggest that we add if_hardware_description, or something such as that, to use for the sort of descriptions that WinPcap provides, and use if_description for the user-oriented description.


More information about the pcap-ng-format mailing list