[pcap-ng-format] The "scope" of the Name Resolution Block

[Guy Harris]

On Sep 1, 2015, at 10:24 AM, Guy Harris <guy at alum.mit.edu> wrote:

> On Sep 1, 2015, at 7:53 AM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:
> 
>> If its scope is only the local SHB section:
>> 
>> - Then as a capture device, you'd have to repeat it for each section
>> in a file, if you add new sections (due to things like interfaces
>> going away or their local IPs changing due to DHCP, since the only
>> means we have of doing that is by adding SHBs).
> 
> That's a bug.

As for interfaces going away, perhaps we should have some type of block to indicate interface events.  They would include an interface ID, a time stamp, an event type, and type-dependent information.  One type might be "other", with the type-dependent information being a UTF-8 string describing the event.