[pcap-ng-format] "Hardware, OS, User application" - separate options for "what did the capture?" and "what's processed the file"?

Guy Harris guy at alum.mit.edu
Tue May 31 08:30:10 UTC 2016


On May 30, 2016, at 11:35 PM, Guy Harris <guy at alum.mit.edu> wrote:

> As per "to which the physical interface on which the capture was done is attached", this should probably be an Interface Description Block option.  We already have if_os for "the OS that machine is running"; we should probably add "if_hardware" - which, if that information is available, should perhaps report a combination of both the system hardware and the network adapter hardware, e.g.
> 
> 	MacBook Pro, AirPort Extreme, Broadcom BCM43xx 1.0 (7.21.95.175.1a6)
> 
> or even
> 
> 	MacBookPro11,5, AirPort Extreme, Broadcom BCM43xx 1.0 (7.21.95.175.1a6)
> 
> for my machine's Wi-Fi adapter

Or perhaps if_syshardware for the system hardware and if_hardware for the adapter hardware.


More information about the pcap-ng-format mailing list