[pcap-ng-format] Separate options for "user" and "vendor" descriptions of an interface?

Guy Harris guy at alum.mit.edu
Mon Jan 26 23:32:48 UTC 2015


On Jan 26, 2015, at 3:06 PM, Jasper Bongertz <jasper at packet-foo.com> wrote:

> There is an option called "if_MACaddr" in the PCAPng interface block
> specifications, but so far I have never seen a file where it is
> actually present

That's primarily because libpcap/WinPcap doesn't yet have an API to provide it, so dumpcap doesn't bother to fetch it.

That's on one of my many TODO lists (the new APIs will be one to get interface properties for a single interface and a replacement for pcap_findalldevs()/pcap_findalldevs_ex(), using pcap-ng option codes to indicate which properties to get and to indicate which properties were gotten).

> (same goes for "if_IPv4addr" and "if_IPv6addr").

Dumpcap, however, *could* provide those with the existing APIs, although there's no "get properties for a single interface" API, so it'd have to use pcap_findalldevs() and then get the appropriate addresses.


More information about the pcap-ng-format mailing list