[pcap-ng-format] The "scope" of the Name Resolution Block

[Jasper Bongertz]

on Mittwoch, 2. September 2015 at 14:22 you wrote:

> On Tue, Sep 1, 2015 at 11:27 PM, Guy Harris <guy at alum.mit.edu> wrote:
>>
>> On Sep 1, 2015, at 6:54 PM, Hadriel Kaplan <the.real.hadriel at gmail.com> wrote:
>>
>>> How about a "Interface Event Block", which has as its fixed data the
>>> Interface ID, timestamp, and Event Type which is one of:
>>> 0 = Link Up
>>> 1 = Link Down
>>> 2 = Enabled
>>> 3 = Disabled
>>> 4 = Info Changed
>>
>> At least two file formats (i4b, i.e. ISDN4BSD, and EyeSDN - yes, there's a theme here :-)) have layer 1 event records that have descriptive text as the contents (EyeSDN also has a direction indication, which I guess is user->network or network->user).
>>
>> Should we support something such as that, or should we use custom blocks for them?  It *might* be useful to tie them to an interface (although nothing forbids a custom block from including an interface ID).

> My 2 cents: for ISDN (or really anything on T1/E1 phy) a layer-1 event
> like Loss of Signal should be a Interface Event for Type "Link Down",
> but yeah descriptive text would be useful anyway for things we can't
> map, like alarm indications being set/cleared or out-of-frame and so
> on. I guess adding another Event Type for "Unknown" or "other" (or
> both) would be useful. And of course a string option to go along with
> it.

Agreed, it would be good to add a string option and an "other" type.
Not sure if adding both "other" and "unknown" would make sense, unless
there is a specific reason why someone would use one or the other
(can't think of one right now, but I'm tired... :-))

Cheers,
Jasper
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4015 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150902/22a1fca9/attachment.bin>