Barry Constantine schrieb: > Hello, > > > > My company builds hardware based network analyzers and we are going to > capture 1G/10G line rate and store in native pcap format. > > > > If possible, it would be beneficial for us to store some extra > information in the packet headers that is unique to our ability to use > custom NIC hardware (FCS errors, collisions, etc..). > > > > I looked at the PCAP format and am thinking there are no spare bits / > fields to accomplish this. We do plan to enable nsec timestamp option. > > > > Can anyone tell me if there is a way to store additional information in > the pcap file (per packet) that would not cause problems for normal > Wireshark decoding? > > Hi!
First of all, are you aware of: http://wiki.wireshark.org/Development/LibpcapFileFormat ? The sources to look in Wireshark are basically: wiretap/libpcap.c / .h There you'll find PCAP_NSEC_MAGIC (0xa1b23c4d) which is the magic number for a pcap file with nsec resolution. Simply use this number and the normal pcap file format and you'll get nanosecond timestamp resolution. This is the easy part ;-) Storing additional info is not that easy :-( a) You could build up your own pcap network link type (I don't know the details here, if it would be possible to put stuff like FCS errors in it). Anyway, in that case you'll need to implement your own special file handling in Wireshark's wiretap and a dissector to display it then. b) You could also use pcapng http://wiki.wireshark.org/Development/PcapNg which is especially developed to store additional info as you described, but in Wireshark it's in experimental state for quite a while (e.g. you can store special information in that file, but it won't be currently displayed). I wouldn't expect to have big progress in the near future here, unless you spend some effort yourself ... Looking at the two alternatives I see, I would like to see some effort spend in b), as this would be the much cleaner solution in the long run ... Regards, ULFL _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org https://wireshark.org/mailman/listinfo/wireshark-dev
