On Apr 5, 2011, at 11:41 AM, Darren Reed wrote:
> My reading of your list of tradeoffs is that even for pcap-NG, LINKTYPE_TEXT
> is required as it has no other way to record text (no comment fields, for
> example, attached to packet blocks.)
Actually, yes, it does - just about every block can
Guy Harris wrote:
On Apr 4, 2011, at 10:09 PM, Darren Reed wrote:
Is there a DLT type for "plain text"?
No.
That is, can I record or insert text based comments or other data to a pcap
file?
No, but you can record them in a pcap-NG file.
My reading of your list of tra
On Apr 4, 2011, at 10:09 PM, Darren Reed wrote:
> Is there a DLT type for "plain text"?
No.
> That is, can I record or insert text based comments or other data to a pcap
> file?
No, but you can record them in a pcap-NG file.
The tradeoffs:
With LINKTYPE_PPI+LINKTYPE_TEXT, with no ch
Is there a DLT type for "plain text"?
That is, can I record or insert text based comments or other data to a
pcap file?
Why could or would this be significant?
Well, if I was using DLT_PPI that allows multiple types of packets to be
recorded in a single file, why can't one of those DLT's be
