Guy Harris wrote:
On Apr 4, 2011, at 10:09 PM, Darren Reed wrote:
Is there a DLT type for "plain text"?
No.
That is, can I record or insert text based comments or other data to a pcap
file?
No, but you can record them in a pcap-NG file.
My reading of your list of tradeoffs is that even for pcap-NG,
LINKTYPE_TEXT is required as it has no other way to record text (no
comment fields, for example, attached to packet blocks.)
The handling of the presence of LINKTYPE_TEXT will be the same for any
other link type that is unknown to the tools that encounter it, so
there's nothing new or special about that.
For that matter, it may be worthwhile improving the failure modes of
tcpdump, if only in dealing with LINKTYPE_PPI.
So I'll ask, does anyone think that LINKTYPE_TEXT should not be added?
Darren
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.