[pcap-ng-format] EPB hash algorithms

Guy Harris gharris at sonic.net
Thu Sep 26 01:51:54 UTC 2019


Speaking of hash algorithms:

	1) Is "2's complement" just the two's-complement sum of (bytes, 16-bit words, 32-bit words, ...) in the packet data?

	2) Is "XOR" just the XOR of (bytes, 16-bit words, 32-bit words, ...) in the packet data?

	3) At what point is the hash supposed to be calculated?  Presumably it's either:

		an optimization so that readers don't need to calculate the hash themselves, as per "The hash allows easier comparison/merging of different capture files..."

		a checksum to detect errors, as per "The hash allows ... reliable data transfer between the data acquisition system and the capture library."

	   For the first of those, it can be calculated by any hardware or software up to the point at which the packet is to be first written to the file.

	   For the second of those, it should presumably be done by "the data acquisition system".


More information about the pcap-ng-format mailing list