-----BEGIN PGP SIGNED MESSAGE-----
>>>>> "Darren" == Darren Reed <[EMAIL PROTECTED]> writes:
Darren> No, it's not that private :) What I'm proposing here is a way in
Darren> which people can put custom data into the pcap files without having
Darren> too be too concerned about what values are safe for the type field
Darren> and what values aren't.
Darren> By using a BIG field (such as the size of the guid_t Microsoft uses
Darren> to identify programs, objects, etc), it gives people scope to put
Darren> something meaningful in the record type.
okay, it is a good idea, but a lot of space.
Consider that others want to have much smaller headers already.
Darren> I suppose another side of this might be to do like this:
Darren> enum pcap1_info_types {
Darren> PCAP_DATACAPTURE,
Darren> PCAP_TIMESTAMP,
Darren> PCAP_PRIVATE_BASE=0x80000000,
Darren> };
Darren> and in so doing, effectively reserve 0-0x7fffffff for your registry
That's mostly fine.
I was thinking of doing:
PCAP_DATACAPTURE = 'DATA';
camelot-054-[~] michael 1030 %cat >/tmp/d1
DATA
camelot-054-[~] michael 1032 %hexdump /tmp/d1
0000000 4144 4154 000a
PCAP_DATACAPTURE = 0x41444154
(The Amiga Manx/Lattice C compilers used to let one use multiple
character literals like above. I think that C89 said not to.)
Darren> On the other, you have application specific data that has been
Darren> inserted for some specific purpose.
We certainly could have a standard sub-container definition like you
indicated.
Darren> And having said that, my suggestion above could lead to a higher
Darren> occurance of problems through people using PCAP_PRIVATE_BASE+n
Darren> (where n is 0..9, say) for their own purposes and too many
I'd like to avoid that by not allocating the numbers sequentially.
Darren> I'm saying all this because I'm working on an application where
Darren> we'd love to put private data in the libpcap files :)
Good. So you can test the code :-)
- --
] ON HUMILITY: to err is human. To moo, bovine. | firewalls [
] Michael Richardson, Xelerance Corporation, Ottawa, ON |net architect[
] [EMAIL PROTECTED] http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys
iQCVAwUBQGHa/4qHRg3pndX9AQH/1AQA4/dpzb0HdqJJCdvN9au4gjprWTGQa/NB
evgfJiu/5cjUejj6G2RM3hnkuLbUjW9evyk4+nDw06fQPLmDRW0RE5IdAoCuIbRD
RBRmh1JuBalIbYP6aaTxd0UaEM0EC4JS2yJvJIHwrxM+w46gK7RTs/eh4tJA9UH+
jRndQxz3t0E=
=vD4S
-----END PGP SIGNATURE-----
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]
