Thanks Guy. That's fine by me. I was just looking for clarificatiion.
Best regards...Paul
Sent from Samsung Mobile on O2
-------- Original message --------
From: Guy Harris
Date:11/06/2016 01:18 (GMT+00:00)
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] PCAP-NG Block Formats
On Jun 10, 2016, at 4:09 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
> The spec should discuss that more, including emphasizing that a reader must pay attention to the block total length when processing options - or deciding whether there are any options to process. I'll look at doing that.
OK, the spec now says
All the block bodies MAY embed optional fields. Optional fields can be used to insert some information that may be useful when reading data, but that is not really needed for packet processing. Therefore, each tool can either read the content of the
optional fields (if any), or skip some of them or even all at once.
Skipping all the optional fields at once is straightforward because most of the blocks are made of a first part with fixed format, and a second optional part. Therefore, the Block Length field (present in the General Block Structure, see Section 3.1)
can be used to determine how many bytes of optional fields, if any, are present in the block. That value can be used to determine whether the block has optional fields (if it is zero, there are no optional fields), to check, when processing optional fields,
whether any optional fields remain, and to skip all the optional fields.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:
https://www.wireshark.org/lists/wireshark-dev
Unsubscribe:
https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
______________________________________________________________________
This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.
Any views or opinions expressed are solely those of the author and do not necessarily represent those of Advance Seven Ltd. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.
Advance Seven Ltd. Registered in England & Wales numbered 2373877 at Endeavour House, Coopers End Lane, Stansted, Essex CM24 1SJ
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________