Wireshark · Wireshark-dev: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13

[Anders Broman <anders.broman@xxxxxxxxxxxx>]

-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: den 13 maj 2013 08:11
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13


On May 12, 2013, at 10:57 PM, Anders Broman <a.broman@xxxxxxxxxxxx> wrote:

>> So either this is a bad idea, don't pursue it or everything we can 
>> read we should be able to write in pcap-ng as a temporary file at least.
>
>...or if we're going to store the contents of packet *not* just generated by gluing together stuff from the capture file (e.g., stuff generated by decompressing packet data or decrypting packet data), we should >store it in a temporary file with a format that we control, rather than a capture file format.  (Yes, that means that the results of that won't be *saved*, but there's no obligation for us to *avoid* regenerating >decompressed/decrypted/etc. packet data.)

True, but having a file where all the heavy lifting is already done but retaining the possibility of regenerating everything would probably speed up the subsequent usage of the file and
Might be an advantage but perhaps it all becomes too complicated then.

>I.e., having a capture file format that saves *arbitrary higher level packets* so that we can just read those packets is *NOT* a required goal of this project.
Yes but it might be a good thing :-)

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe