[Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>]

On Wed, 29 Oct 2003, Guy Harris wrote:

> On Wed, Oct 29, 2003 at 11:38:24AM +1300, Jesper Peterson wrote:
> > Are libpcap TNG plans online somewhere?
> 
> No - there aren't any plans yet, just ideas such as
> 
> 	1) Michael Richardson suggested that it be possible to
> 	   concatenate files with "cat" (i.e., it should be OK to have a
> 	   file header in the middle of a bunch of packets);
> 
> 	2) I'd like to have it be able to handle a multi-interface
> 	   capture, giving interface names (if available) and link-layer
> 	   types (i.e., different interfaces could have different
> 	   link-layer types);
> 
> 	3) I'd like the per-packet header to include information such as
> 	   the length of the packet's CRC field, if any (to handle both
> 	   PPP, where it can change during a session with negotiation,
> 	   and various LANs where sometimes you get a CRC from the
> 	   driver and sometimes you don't), a direction flag
> 	   (incoming/outgoing/promiscuous, at minimum, and maybe
> 	   including incoming unicast/incoming multicast/incoming
> 	   broadcast, but also including "unknown") and possibly
> 	   link-layer-dependent flags such as "bad CRC", "runt frame",
> 	   "frame too long", etc.;
> 
> 	4) I'd like the format to be extensible, with both per-file
> 	   attributes and per-packet attributes, in TLV form, so that
> 	   new capabilities can be added without breaking existing
> 	   software that reads the file;

Should we develop an RFC?

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com