I have an output style question before I continue hacking at print-sflow.c. Some of the fields in the PDUs are encoded - the top two bits are a format which change the meaning of the remaining 30 bits. my question is whether the printing should simply emit the format and the value as separate items, or change the "description" text based on the format. For example, sflowtool from inmon does the latter mostly but also a bit of the former:
switch(sample->inputPortFormat) { case 3: sf_log("inputPort format==3 %u\n", sample->inputPort); break; case 2: sf_log("inputPort multiple %u\n", sample->inputPort); break; case 1: sf_log("inputPort dropCode %u\n", sample->inputPort); break; case 0: sf_log("inputPort %u\n", sample->inputPort); break; } switch(sample->outputPortFormat) { case 3: sf_log("outputPort format==3 %u\n", sample->outputPort); break; case 2: sf_log("outputPort multiple %u\n", sample->outputPort); break; case 1: sf_log("outputPort dropCode %u\n", sample->outputPort); break; case 0: sf_log("outputPort %u\n", sample->outputPort); break; } what is/should be the way that is done in tcpdump? rick jones - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.