Wireshark-dev: Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap?
From: "Benn Bollay" <benn@xxxxxx>
Date: Fri, 12 Jan 2007 09:43:20 -0800
Hello GV - Thanks for the reply! It's interesting to see how people work around the limitations in the current pcap format. One I'm is thinking of doing is utilizing the Ethernet Trailer (which you almost /never/ see anymore) to associate a lot of the data that pcap-ng would provide in a more elegent fashion. With a custom dissector, that should give us a lot of the features we're looking for. Is the seeking problem a mechanics issue, or an API issue? I'd be interest in talking about it more with you, or perhaps contributing a bit if that makes sense. How difficult will the integration into the std tools (tcpdump, Wireshark, et al) be once a consistent API is implemented? One wonders if it would be possible to provide a pcap interface to a pcap-ng file, and circumvent a lot of the immediate compatibility issues. Cheers! --Benn > -----Original Message----- > From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev- > bounces@xxxxxxxxxxxxx] On Behalf Of Gianluca Varenni > Sent: Thursday, January 11, 2007 4:39 PM > To: Developer support list for Wireshark > Subject: Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap? > > Benn, > > regarding the NTAR project (i.e. the only implementation of the pcap-ng > "wannabe" spec so far) that I "maintain", I've been pretty busy in the > last > year or so, thus not being able to work on it. The project is not dead at > all, I'm simply giving priority to other tasks... > > As far as the integration with wireshark is concerned, technically > speaking > there is one big feature missing from NTAR that is needed by wireshark, > that > is seeking within a file. > I started working on it during the xmas holidays, but I haven't come out > with a definitive API for it. The main problem I'm having is the hierarchy > of the file (packets are embedded in blocks which are grouped into > sections) > that make everything much more complicated. I plan to work on it in the > upcoming weeks and post something on the NTAR website as soon as possible. > > I think that the wireshark devs have a great interest in moving to pcap-ng > as the standard trace format (being it through NTAR or reimplementing the > spec), I have no idea where this task sits within the Wireshark roadmap, > and > if this task would fit before or after the 1.0 milestone. > > Have a nice day > GV > > > > ----- Original Message ----- > From: "Benn Bollay" <benn@xxxxxx> > To: "Developer support list for Wireshark" <wireshark-dev@xxxxxxxxxxxxx> > Sent: Wednesday, January 10, 2007 2:27 PM > Subject: [Wireshark-dev] Is pcap-ng/ntar still in roadmap? > > > > Hello all - > > > > Is the next-gen pcap format still in the roadmap at all? I've heard > > nothing about it for ages; there doesn't seem to be any discussions, nor > > any implemention details for well over a year now. > > > > I'm trying to decide whether I should hack-up the libpcap format or > > spend more development effort and move entirely to something else. > > > > Cheers, > > --Benn > > _______________________________________________ > > Wireshark-dev mailing list > > Wireshark-dev@xxxxxxxxxxxxx > > http://www.wireshark.org/mailman/listinfo/wireshark-dev > > _______________________________________________ > Wireshark-dev mailing list > Wireshark-dev@xxxxxxxxxxxxx > http://www.wireshark.org/mailman/listinfo/wireshark-dev
- Follow-Ups:
- Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap?
- From: Guy Harris
- Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap?
- From: Gianluca Varenni
- Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap?
- Prev by Date: Re: [Wireshark-dev] proto_tree_add_item() with range_string
- Next by Date: Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap?
- Previous by thread: Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap?
- Next by thread: Re: [Wireshark-dev] Is pcap-ng/ntar still in roadmap?
- Index(es):
- Get Wireshark
- Download
- Code of Conduct