On Aug 31, 2016, at 11:49 AM, Jonathan Brucker <jonathan.bru...@gmail.com> wrote:
> On Wed, Aug 31, 2016 at 6:27 PM, Guy Harris <g...@alum.mit.edu> wrote: >> On Aug 31, 2016, at 11:03 AM, Jonathan Brucker <jonathan.bru...@gmail.com> >> wrote: >> >>> RFtap is here to bridge this gap, for all protocols. >> >> That's exactly why I don't like its current design! >> >> Can we please kill off the idea of meta-data headers that contain link-layer >> header types, so that you have a LINKTYPE_/DLT_ value where the packet >> payload could have extremely different protocol link-layer header types, now >> and forever? >> >> Now, if you want to provide the *measured* information in a >> protocol-independent fashion, a better way, that doesn't have the "LINKTYPE_ >> value says nothing whatsoever about the actual link-layer protocol" problem, >> we could have *multiple* LINKTYPE_ values, for "RFtap followed by Radiotap >> followed by 802.11" and "RFtap followed by GSMTAP followed by GSMTAP >> payload" and so on. > > We could split the 32-bit value of LINKTYPE It's a 16-bit value in pcapng: http://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?url=https://raw.githubusercontent.com/pcapng/pcapng/master/draft-tuexen-opsawg-pcapng.xml&modeAsFormat=html/ascii&type=ascii#rfc.section.4.2 so you don't have 32 bits to use. >>> The cross section of BPF users and RFtap users may be empty. >>> RFtap is more oriented towards higher-level tools such as Wireshark >>> and Scapy. >> >> You are aware that Wireshark, at least, uses libpcap/WinPcap to capture, and >> therefore uses BPF when capturing? I'm not sure about Scapy, but it might >> support libpcap filters as well. > > Sure, I meant users that actually use the *filters* in BPF. For higher > level tools, BPF is mostly used just a conduit, with a filter to > accept all packets. > The RFtap the filtering is expected to be done mostly using Wireshark > dissectors or Scapy dissectors. Actually, the Wireshark developers expect people to do libpcap-layer filtering when using Wireshark, and often recommend doing it. _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers