[pcap-ng-format] EPB hash algorithms
Stephen Hemminger
stephen at networkplumber.org
Wed Sep 25 17:03:15 UTC 2019
The Enhanced Packet Block format has option for hash.
The epb_hash does not support the most common hash algorithm
supported by most NIC's. The Toeplitz hash function is used by
both Linux and Windows, and is required as part of the NDIS spec
so hardware vendors all do it.
But the documentation for ebp_hash says:
The hashing algorithm can be:
2s complement (algorithm octet = 0, size=XXX),
XOR (algorithm octet = 1, size=XXX),
CRC32 (algorithm octet = 2, size = 4),
MD-5 (algorithm octet = 3, size=XXX),
SHA-1 (algorithm octet = 4, size=XXX).
Why not Toeplitz?
More information about the pcap-ng-format
mailing list