[pcap-ng-format] EPB hash algorithms

Stephen Hemminger stephen at networkplumber.org
Wed Sep 25 17:03:15 UTC 2019


The Enhanced Packet Block format has option for hash.
The epb_hash does not support the most common hash algorithm
supported by most NIC's. The Toeplitz hash function is used by
both Linux and Windows, and is required as part of the NDIS spec
so hardware vendors all do it.

But the documentation for ebp_hash says:
The hashing algorithm can be: 
2s complement (algorithm octet = 0, size=XXX), 
XOR (algorithm octet = 1, size=XXX), 
CRC32 (algorithm octet = 2, size = 4), 
MD-5 (algorithm octet = 3, size=XXX), 
SHA-1 (algorithm octet = 4, size=XXX).


Why not Toeplitz?


More information about the pcap-ng-format mailing list