Wireshark-dev: Re: [Wireshark-dev] [ntar-workers] Extending Wireshark libpcap format support, o
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Fri, 28 Sep 2007 02:22:05 +0200
Gianluca Varenni schrieb:

I have reviewed that doc for a few hours today. Now I have a printout
with lot's of minor comments probably worth to be included. Most of them
is about clarifying stuff and make the document easier to read (well,
and some typos). The only really questionable thing I found was the name
resolution block. I don't see a reason to have optional block content
and options as well - in fact it was hard to understand. Why not use
only option fields there?
Uhm, i think i'm missing the point here. the block contains a list of dns records in the form IP->name\0name\0, and then the options at the end of the block itself.
The current approach is very IP centric. So if there's any name resolution not so IP like (IPX, ...), the core block will contain nothing but only (to be defined) option fields. 

So in the end won't it be better to have only option fields here?

I guess it would be a good idea to include my review comments into the
spec. What would be best way to get them included?
Just send them to me and i can include them. Otherwise, the XML source of the document is available at 

http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.xml

just edit it and send it to me.

I'll continue to work on this probably from monday on ...

Regarding changes in the file itself while it's open: I guess the best
way to include pcapng into WS is to treat the capture file read only (as
today). Additional stuff has to be kept in memory (user comments, name
resolvings, ...) until the capture file is saved to disk. After the file
is saved, it has to be read completely again, so file offsets of packet
data is "updated" in memory.
I would use the same approach, at least for v1. If it proves to be too slow/inefficient, there's always time to improve it. 
ACK

Regards, ULFL