Wireshark-dev: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13
From: Guy Harris <[email protected]>
Date: Sun, 12 May 2013 23:10:53 -0700
On May 12, 2013, at 10:57 PM, Anders Broman <[email protected]> wrote:

> So either this is a bad idea, don't pursue it or everything we can read we should be able to write in pcap-ng
> as a temporary file at least.

...or if we're going to store the contents of packet *not* just generated by gluing together stuff from the capture file (e.g., stuff generated by decompressing packet data or decrypting packet data), we should store it in a temporary file with a format that we control, rather than a capture file format.  (Yes, that means that the results of that won't be *saved*, but there's no obligation for us to *avoid* regenerating decompressed/decrypted/etc. packet data.)

I.e., having a capture file format that saves *arbitrary higher level packets* so that we can just read those packets is *NOT* a required goal of this project.