[Guy Harris <gharris@xxxxxxxxx>]

Gianluca Varenni wrote:

> Wiretap saves the offset of each packet into memory to support random 
> access to the file. The offsets should be 64 bits, and together with the 
> offsets you need to save the byte order of that block, or alternatively 
> the ID of the section containing the packet (a file can contain multiple 
> sections, each one with a different byte order, different interface 
> descriptions, bla bla bla).

What will the API offered by NTAR be to allow random access?  Will it 
maintain the byte order table (so that it will look up the offset and 
determine what byte order to use), or will the caller of NTAR be 
expected to supply that?

> Probably the list of interfaces and/or sections in a file will be saved 
> in some specific pcap-NG structure used by wiretap, so no direct 
> modification should be done in wiretap for this (not 100% sure, correct 
> me if I'm wrong).

Wiretap will need to provide an API that supplies interface information 
to its caller; as it supports non-libpcap and non-pcap-NG files, it 
would probably need to supply that in a form abstracted enough to handle 
other file types.