LEGO wrote:
I been thinking on two ways to handle this, either compeletely by the
wiretap module or with the help of a specific dissector.
That's currently how similar issues with the nettl file format are being
handled.
On the other hand If all of it is done by wiretap:
- one day one users could use editcap to covert between k12 file
format and other formats, porvided that at least libpcap's
implementation supports per-packet encapsulation. As wiretap's
libpcap format does not implement per-packet encapsulation yet.
In the long term, it'll have to handle that...
...and the way it'll handle it is similar to how it'd be handled for the
k12xx's - the "per-packet" encapsulation will really be "per-interface",
with each interface having a bunch of information about it available.
(See http://www.tcpdump.org/pcap/pcap.html for information on that format.)
There's currently no time frame for when that'll be implemented.
One issue for that is that the per-interface information should be made
extensible, so that it can handle different file types. The pcap-NG
format is extensible in a number of places, including in the
per-interface properties; we could probably just add to it new
properties corresponding to any k12xx per-source properties not in the
set in
http://www.tcpdump.org/pcap/pcap.html#sectionidb
- The only way (I'm aware of) the user can talk with wiretap is via
environment variables. That makes very cumbersome to configure the
import mechanism. Other than that users should know exactly what's in
the files before opening the file. I thought in using an environment
variable to point to a config file.
Environment variables are a bit clumsy in all cases, especially if
you're running Ethereal directly from the GUI *and* want to change it
per-invocation, and I think they're even clumsier in Windows.
It sounds as if the information that needs to be provided by the user is
information to indicate the stack used by a particular source. Is that
because the information provided in the capture file - the name of a
.stk file for the source, right? - isn't sufficient to indicate the
stack used in all cases?
Luis
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
