Wireshark · Ethereal-dev: Re: [ntar-workers] Re: [Ethereal-dev] Re: NTAR - PCAP next generation dump file formatimplementation

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

>   Can any of these things be written without seeking backwards in the
> file? Can we make sure that the value 0, or some other nonsense value
> can be inserted to mean, "I didn't calculate that", and let a
> post-processor worry about fixing the actual values in.
> 

I agree with the implied meaning above that a no seeking backward
solution is absolutely required so that one can pass a capture through
a pipe.


Number of bytes until the next marker should be possible to implement
without seeking in the file. Just make a new marker once every 1Mbyte
into the file   and if there is not enough space left to fit the next
packet to write, just add some padding data until the next marker.

Then one marker would always know that the next marker starts 1 MB
from now and no seeking of the file required.

The number of packets until next marker and the timestamps can be left
as zero   indicating "i didnt calculate that" and be left for a
postprocessing tool to calculate if required.

If the bytes until next marker points to beyong the end of the file  
this would just mean : no more markers.



On 6/27/05, Michael Richardson <mcr@xxxxxxxxxxxxxxxxxxxxxx> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> 
> >>>>> "Gianluca" == Gianluca Varenni <gianluca.varenni@xxxxxxxxx> writes:
>     Gianluca> In my opinion the marker should contain the following informations
>     Gianluca> - number of packets up to the next "marker block"
>     Gianluca> - number of bytes up to the next "marker block"
>     Gianluca> - timestamp of the first and last packet up to the next "marker block"
>     Gianluca> - offset to the next "marker block"
>     Gianluca> - other??
> 
>   Can any of these things be written without seeking backwards in the
> file? Can we make sure that the value 0, or some other nonsense value
> can be inserted to mean, "I didn't calculate that", and let a
> post-processor worry about fixing the actual values in.
> 
> - --
> ] Michael Richardson          Xelerance Corporation, Ottawa, ON |  firewalls  [
> ] mcr @ xelerance.com           Now doing IPsec training, see   |net architect[
> ] http://www.sandelman.ca/mcr/    www.xelerance.com/training/   |device driver[
> ]                    I'm a dad: http://www.sandelman.ca/lrmr/                 [
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
> Comment: Finger me for keys
> 
> iQCVAwUBQr9mF4qHRg3pndX9AQFV4QQA1bLwRWvpq5MfRt0Tucppcc4w5iDZDL1f
> amC/yf5PDyDqVV/0jHld4Xl9j2yeUyTSN+tfZzj2GeAdLMHh7LIpHI+3R9pZfwCv
> nXm3muzNMdiDfCwVZZjyJH+/jCGsAohDZ2zMrsI2vcNUz7JU8jS4jhDSQRKQeVhl
> M0YBD5KJK+M=
> =2NZR
> -----END PGP SIGNATURE-----
>