On Thu, Nov 01, 2001 at 01:38:11PM -0600, Gilbert Ramirez wrote:
> My code creates libpcap-style files. I need a new DLT value for
> the linktype, for 2 reasons. First, the packet I write to the file
> will contain some extra initial information which contains
> the true, per-packet link type. That is, like DTL_LINUX_SLL,
> I'll be adding some bytes in order to provide for per-packet
> link types instead of per-file link types. Secondly, the
> information added to the packet will contain some additional
> meta-data which is important to IOS developers.
We should probably make both of those available in some future capture
file format, as has been suggested in the past.
The future capture file format should probably have a list of network
interfaces on which captures were done, giving:
the name of the interface;
the link-layer type of the interface;
perhaps the speed of the network it's on, in bits/second (the
same value that would be reported for the interface as its
ifSpeed - perhaps with a flag indicating whether the value is
ifSpeed or RFC 2863's ifHighSpeed);
and not have a single link-layer type flag for the file. Packets would
have either the ordinal number of the interface or perhaps some tag
value that'd be in the entry for the interface.
There's been some discussion of additional per-packet meta-data here,
and one mention in the ethereal-dev mailing list as well.
But moving on to the present:
> If possible, I'd like the name to be something like
> DLT_CISCO_IOS.
I've added DLT_CISCO_IOS, with a value of 118.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
