Wireshark · Ethereal-dev: Re: [Ethereal-dev] Need an extra bit in the packet-header struct.

[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Jun 28, 2004 at 11:44:26PM -0700, Ben Greear wrote:
> I have need for an extra bit in the header for each packet.
> This is to tell me whether the packet was received or transmitted
> on this interface.

To which "packet header structure" are you referring?

> Since the length fields are 32-bit, and there is no 4GB packet to be
> had, I was thinking I could just use the high-bit there.

If it's "wtap_pkthdr", you might as well just add an entire field -
especially given that "received or transmitted" don't cover all the
possibilities; there's also

	unknown (if you really don't know whether the packet was
	received or transmitted)

	received {unicast,broadcast,multicast} (some packet capture
	mechanisms supply this information; current libpcap doesn't pass
	that through, but it might do so in the future)

along with "transmitted" and "received but that's all I know about it".

If it's "frame_data", there's already a flag field, although, again, the
direction indicator should be more than one bit.