[pcap-ng-format] The "scope" of the Name Resolution Block

[Jasper Bongertz]

>> If its scope is only the local SHB section:
>> 
>> - Then as a capture device, you'd have to repeat it for each section
>> in a file, if you add new sections (due to things like interfaces
>> going away or their local IPs changing due to DHCP, since the only
>> means we have of doing that is by adding SHBs).

> That's a bug.

> What we *should* have is an Interface Update Block, which has, as
> its fixed data, an interface ID, followed by the same options that
> an Interface Description Block has, indicating what interface
> properties changed.  Perhaps it should also have a time stamp to
> indicate *when* the information changed.

> I'd vote for "scope is the local SHB section" plus "Interface
> Update Block so we don't need to create a new section just because
> an interface changed its IP address".

I second that vote. Interface Update blocks sound useful even though I
guess they'll not be used a lot.

Cheers,
Jasper
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4015 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150901/ba534e80/attachment.bin>