Re: [tcpdump-workers] RFC: DLT for application TCP stream capture

2015-01-14 Thread Michael Tuexen
On 14 Jan 2015, at 18:19, Denis Ovsienko de...@ovsienko.info wrote: Eventually, we'll be using this format to debug multi-path TCP, in which case the IP addresses (and maybe even the IP4/IP6-ness of it) might change. Also there exists SCTP, which implements the concept of variable

Re: [tcpdump-workers] RFC: DLT for application TCP stream capture

2015-01-14 Thread Guy Harris
On Jan 14, 2015, at 12:10 PM, Michael Tuexen michael.tue...@lurchi.franken.de wrote: On 14 Jan 2015, at 18:19, Denis Ovsienko de...@ovsienko.info wrote: Eventually, we'll be using this format to debug multi-path TCP, in which case the IP addresses (and maybe even the IP4/IP6-ness of it)

Re: [tcpdump-workers] RFC: DLT for application TCP stream capture

2015-01-14 Thread Paul LeoNerd Evans
On Tue, 13 Jan 2015 19:32:46 -0800 Guy Harris g...@alum.mit.edu wrote: LINKTYPE_IP_PAYLOAD, or something such as that, with a link-layer (pseudo-)header containing: I'm happy with that as a name. an indication of whether the network-layer addresses are IPv4 or IPv6; source

Re: [tcpdump-workers] RFC: DLT for application TCP stream capture

2015-01-14 Thread Paul LeoNerd Evans
On Wed, 14 Jan 2015 11:57:53 -0500 Michael Richardson m...@sandelman.ca wrote: It does momentarily seem wasteful to repeat the source/destination information in every single packet (especially in the case of IPv6 with its 256bits of addressing information). Though I don't

Re: [tcpdump-workers] RFC: DLT for application TCP stream capture

2015-01-14 Thread Michael Richardson
Paul \LeoNerd\ Evans leon...@leonerd.org.uk wrote: I wonder though, whether the flags could be combined with the IP version field, given as the version in the underlying (real) IP packet anyway is only a 4-bit field. 1 byte | Flags and IP version: bit7 [ ...W ]

Re: [tcpdump-workers] RFC: DLT for application TCP stream capture

2015-01-14 Thread Paul LeoNerd Evans
On Wed, 14 Jan 2015 11:57:53 -0500 Michael Richardson m...@sandelman.ca wrote: It does momentarily seem wasteful to repeat the source/destination information in every single packet (especially in the case of IPv6 with its 256bits of addressing information). Though I don't

Re: [tcpdump-workers] RFC: DLT for application TCP stream capture

2015-01-14 Thread Denis Ovsienko
Eventually, we'll be using this format to debug multi-path TCP, in which case the IP addresses (and maybe even the IP4/IP6-ness of it) might change. Also there exists SCTP, which implements the concept of variable (0..65535) number of streams for each direction of an association between a pair