[pcap-ng-format] The "scope" of the Name Resolution Block
Jasper Bongertz
jasper at packet-foo.com
Tue Sep 1 18:07:55 UTC 2015
>> If its scope is only the local SHB section:
>>
>> - Then as a capture device, you'd have to repeat it for each section
>> in a file, if you add new sections (due to things like interfaces
>> going away or their local IPs changing due to DHCP, since the only
>> means we have of doing that is by adding SHBs).
> That's a bug.
> What we *should* have is an Interface Update Block, which has, as
> its fixed data, an interface ID, followed by the same options that
> an Interface Description Block has, indicating what interface
> properties changed. Perhaps it should also have a time stamp to
> indicate *when* the information changed.
> I'd vote for "scope is the local SHB section" plus "Interface
> Update Block so we don't need to create a new section just because
> an interface changed its IP address".
I second that vote. Interface Update blocks sound useful even though I
guess they'll not be used a lot.
Cheers,
Jasper
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4015 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150901/ba534e80/attachment.bin>
More information about the pcap-ng-format
mailing list